Scalar functions

Conditional functions

case()

Evaluates a list of predicates and returns the first result expression whose predicate is satisfied.

Arguments

• predicate: An expression that evaluates to a boolean value.
• then: An expression that gets evaluated and its value is returned from the function if predicate is the first predicate that evaluates to true.
• else: An expression that gets evaluated and its value is returned from the function if neither of the predicate evaluate to true.

Returns

The value of the first then whose predicate evaluates to true, or the value of else if neither of the predicates are satisfied.

Example

case(predicate, then, else, ...)

['sample-http-logs']
| extend Category = case(
    req_duration_ms < 18,
    resp_body_size_bytes >= 18, 
    resp_header_size_bytes > 35
)

iff()

Evaluates the first argument (the predicate), and returns the value of either the second or third arguments. The second and third arguments must be of the same type.

Arguments

• predicate: An expression that evaluates to a boolean value.
• ifTrue: An expression that gets evaluated and its value returned from the function if predicate evaluates to true.
• ifFalse: An expression that gets evaluated and its value returned from the function if predicate evaluates to false.

Returns

This function returns the value of ifTrue if predicate evaluates to true, or the value of ifFalse otherwise.

Examples

iff(predicate, ifTrue, ifFalse)

['sample-http-logs']
| project Status = iff(req_duration_ms == 1, "numeric", "Inactive")