.create function

Creates a stored function, which is a reusable KQL query, with the given name. The function definition is persisted with the database metadata.

Functions can call other functions (recursiveness isn't supported). Besides, let statements are allowed as part of the Function Body. See let statements.

Rules for parameter types and CSL statements are the same as for let statements.


.create function [ifnotexists] [with ([docstring = Documentation] [, folder = FolderName] )] [view = View] [, skipvalidation = 'true'] )] FunctionName ( ParamName : ParamType [, ...] ) { FunctionBody }


Input parameter Type Description
ifnotexists bool Will be executed only if the function doesn't exist (when set to true).
docstring String A description of the function.
folder String The name of the folder tag.
view bool Designates this function as a stored view.
skipvalidation bool When set to true, it will run validation logic on the function and fail if function isn't valid. (Default: true)
FunctionName(ParamName:ParamType) String (String:datatype) Name of the function, the parameter name and datatype.
FunctionBody A user defined function expression.


Output parameter Type Description
Name String The name of the function.
Parameters String The parameters required by the function.
Body String (Zero or more) let statements followed by a valid CSL expression that is evaluated upon function invocation.
Folder String A folder used for UI functions categorization. This parameter doesn't change the way function is invoked.
DocString String A description of the function for UI purposes.


  • If the function already exists:
    • If ifnotexists flag is specified, the command is ignored (no change applied).
    • If ifnotexists flag is NOT specified, an error is returned.
    • For altering an existing function, see .alter function
  • Requires database user permission.
  • Not all data types are supported in let statements. Supported types are: boolean, string, long, datetime, timespan, double, and dynamic.
  • Use skipvalidation to skip semantic validation of the function. This is useful when functions are created in an incorrect order and F1 that uses F2 is created earlier.

Example: Simple demo function

.create function 
with (docstring = 'Simple demo function', folder='Demo')
MyFunction1()  {StormEvents | limit 100}
Name Parameters Body Folder DocString
MyFunction1 () {StormEvents | limit 100} Demo Simple demo function

Example: Demo function with parameter

.create function
with (docstring = 'Demo function with parameter', folder='Demo')
 MyFunction2(myLimit: long)  {StormEvents | limit myLimit}
Name Parameters Body Folder DocString
MyFunction2 (myLimit:long) {StormEvents | limit myLimit} Demo Demo function with parameter