column_ifexists

Use column_ifexists() to make your queries resilient to schema changes. The function checks if a field with a given name exists in the dataset. If it does, the function returns it. If not, it returns a fallback field or expression that you provide.

This is especially useful when working with datasets that evolve over time or come from multiple sources with different schemas. Instead of failing when a field is missing, your query continues running by using a default. Use this function to safely handle queries where the presence of a field isn’t guaranteed.

Usage

Syntax

column_ifexists(FieldName, DefaultValue)

Parameters

• FieldName: The name of the field to return as a string.
• DefaultValue: The fallback value to return if FieldName doesn’t exist. This can be another field or a literal.

Returns

Returns the field specified by FieldName if it exists in the table schema. Otherwise, returns the result of DefaultValue.

Use case examples

['sample-http-logs']
| project _time, location = column_ifexists('geo.region', ['geo.country'])

['otel-demo-traces']
| extend status_code_field = column_ifexists('status_code', '100')
| extend status_field = column_ifexists('status', 100)
| project _time, trace_id, span_id, status_code_field, status_field

['sample-http-logs']
| project _time, id, threat = column_ifexists('threat_level', status)

List of related functions

• coalesce: Returns the first non-null value from a list of expressions. Use when you want to handle null values, not missing fields.
• iff: Performs conditional logic based on a boolean expression. Use when you want explicit control over evaluation.
• isnull: Checks if a value is null. Useful when combined with other functions for fine-grained control.
• case: Allows multiple conditional branches. Use when fallback logic depends on multiple conditions.
• project: Selects and transforms fields. Use with column_ifexists() to build resilient field projections.

Other query languages