Scalar functions

Conditional functions

Function NameDescription
case()Evaluates a list of conditions and returns the first result expression whose condition is satisfied.
iff()Evaluates the first argument (the predicate), and returns the value of either the second or third arguments

case()

Evaluates a list of conditions and returns the first result whose condition is satisfied.

Arguments

• condition: An expression that evaluates to a Boolean.
• result: An expression that Axiom evaluates and returns the value if its condition is the first that evaluates to true.
• nothingMatchedResult: An expression that Axiom evaluates and returns the value if none of the conditional expressions evaluates to true.

Returns

Axiom returns the value of the first result whose condition evaluates to true. If none of the conditions is satisfied, Axiom returns the value of `nothingMatchedResult`.

Example

``case(condition1, result1, condition2, result2, condition3, result3, ..., nothingMatchedResult)``
``````['sample-http-logs'] |
extend status_human_readable = case(
status_int == 200,
'OK',
status_int == 201,
'Created',
status_int == 301,
'Moved Permanently',
status_int == 500,
'Internal Server Error',
'Other'
)``````

iff()

Evaluates the first argument (the predicate), and returns the value of either the second or third arguments. The second and third arguments must be of the same type.

Arguments

• predicate: An expression that evaluates to a boolean value.
• ifTrue: An expression that gets evaluated and its value returned from the function if predicate evaluates to `true`.
• ifFalse: An expression that gets evaluated and its value returned from the function if predicate evaluates to `false`.

Returns

This function returns the value of ifTrue if predicate evaluates to true, or the value of ifFalse otherwise.

Examples

``iff(predicate, ifTrue, ifFalse)``
``````['sample-http-logs']
| project Status = iff(req_duration_ms == 1, "numeric", "Inactive")``````