The table() function references a table by providing its name as an expression of type string.


table( TableName [, DataScope] )

Learn more about syntax conventions.


Name Type Required Description
TableName string ✔️ The name of the table being referenced. The value of this expression must be constant at the point of call to the function, meaning it cannot vary by the data context.
DataScope string Used to restrict the table reference to data according to how this data falls under the table's effective cache policy. If used, the actual argument must be one of the Valid data scope values.

Valid data scope values

Value Description
hotcache Only data that is categorized as hot cache will be referenced.
all All the data in the table will be referenced.
default The default is all, except if it has been set to hotcache by the cluster admin.


table(T) returns:

  • Data from table T if a table named T exists.
  • Data returned by function T if a table named T doesn't exist but a function named T exists. Function T must take no arguments and must return a tabular result.
  • A semantic error is raised if there's no table named T and no function named T.


Use table() to access table of the current database

table('StormEvents') | count



Use table() inside let statements

The query above can be rewritten as a query-defined function (let statement) that receives a parameter tableName - which is passed into the table() function.

let foo = (tableName:string)
    table(tableName) | count



Use table() inside Functions

The same query as above can be rewritten to be used in a function that receives a parameter tableName - which is passed into the table() function.

.create function foo(tableName:string)
    table(tableName) | count


Such functions can be used only locally and not in the cross-cluster query.

Use table() with non-constant parameter

A parameter, which isn't a scalar constant string, can't be passed as a parameter to the table() function.

Below, given an example of workaround for such case.

let T1 = print x=1;
let T2 = print x=2;
let _choose = (_selector:string)
    (T1 | where _selector == 'T1'),
    (T2 | where _selector == 'T2')