datatable operator
Returns a table whose schema and values are defined in the query itself.
Note
This operator doesn't have a pipeline input.
Syntax
datatable(
ColumnName :
ColumnType [,
...] [
ScalarValue [,
ScalarValue ...] ])
Learn more about syntax conventions.
Parameters
Name | Type | Required | Description |
---|---|---|---|
ColumnName:ColumnType | string | ✓ | The name of column and type of data in that column that define the schema of the table. |
ScalarValue | scalar | ✓ | The value to insert into the table. The number of values must be an integer multiple of the columns in the table. The n'th value must have a type that corresponds to column n % NumColumns. |
Name | Type | Required | Description |
---|---|---|---|
ColumnName: ColumnType | string | ✓ | The name of column and type of data in that column that define the schema of the table. |
ScalarValue | scalar | ✓ | The value to insert into the table. The number of values must be an integer multiple of the columns in the table. The n'th value must have a type that corresponds to column n % NumColumns. |
Returns
This operator returns a data table of the given schema and data.
Example
datatable(Date:datetime, Event:string, MoreData:dynamic) [
datetime(1910-06-11), "Born", dynamic({"key1":"value1", "key2":"value2"}),
datetime(1930-01-01), "Enters Ecole Navale", dynamic({"key1":"value3", "key2":"value4"}),
datetime(1953-01-01), "Published first book", dynamic({"key1":"value5", "key2":"value6"}),
datetime(1997-06-25), "Died", dynamic({"key1":"value7", "key2":"value8"}),
]
| where strlen(Event) > 4
| extend key2 = MoreData.key2
Output
Date | Event | MoreData | key2 |
---|---|---|---|
1930-01-01 00:00:00.0000000 | Enters Ecole Navale | { "key1": "value3", "key2": "value4" } |
value4 |
1953-01-01 00:00:00.0000000 | Published first book | { "key1": "value5", "key2": "value6" } |
value6 |
Feedback
Submit and view feedback for