Use the createview command to define a subquery to create a subset of groups identified by the link command. This virtual set of groups will in turn be used in other commands for further computations.


createview <subquery> as <view_name>


The following table lists the parameters used in this command, along with their descriptions.

Parameter Description


The subquery to create a subset of groups. The subquery must use the rename to expose fields that need to made available when this view is used.


The name of the view.

For examples of using this command in typical scenarios, see:

The following command creates Application Error View view of all the entity groups with application error:

* | link Entity, Label 
  | createview [ 
    * | where Label = 'Application Error' 
    | rename Entity as 'Application Error Entity' 
    ] as 'Application Error View'