array_iff()

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Element-wise iif function on dynamic arrays.

The array_iff() and array_iif() functions are equivalent

Syntax

array_iff(condition_array, when_true, when_false)

Learn more about syntax conventions.

Parameters

Name Type Required Description
condition_array dynamic ✔️ An array of boolean or numeric values.
when_true dynamic or scalar ✔️ An array of values or primitive value. This will be the result when condition_array is true.
when_false dynamic or scalar ✔️ An array of values or primitive value. This will be the result when condition_array is false.

Note

  • The length of the return value will be the same as the input condition_array.
  • Numeric condition values are considered true if not equal to 0.
  • Non-numeric and non-boolean condition values will be null in the corresponding index of the return value.
  • If when_true or when_false is shorter than condition_array, missing values will be treated as null.

Returns

Returns a dynamic array of the values taken either from the when_true or when_false array values, according to the corresponding value of the condition array.

Examples

print condition=dynamic([true,false,true]), if_true=dynamic([1,2,3]), if_false=dynamic([4,5,6]) 
| extend res= array_iff(condition, if_true, if_false)

Output

condition if_true if_false res
[true, false, true] [1, 2, 3] [4, 5, 6] [1, 5, 3]

Numeric condition values

print condition=dynamic([1,0,50]), if_true="yes", if_false="no" 
| extend res= array_iff(condition, if_true, if_false)

Output

condition if_true if_false res
[1, 0, 50] yes no [yes, no, yes]

Non-numeric and non-boolean condition values

print condition=dynamic(["some string value", datetime("01-01-2022"), null]), if_true=1, if_false=0
| extend res= array_iff(condition, if_true, if_false)

Output

condition if_true if_false res
[true, false, true] 1 0 [null, null, null]

Mismatched array lengths

print condition=dynamic([true,true,true]), if_true=dynamic([1,2]), if_false=dynamic([3,4]) 
| extend res= array_iff(condition, if_true, if_false)

Output

condition if_true if_false res
[true, true, true] [1, 2] [3, 4] [1, 2, null]