Batches
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
A query can include multiple tabular expression statements, as long as they're delimited by a semicolon (;) character. The query then returns multiple tabular results. Results are produced by the tabular expression statements and ordered according to the order of the statements in the query text.
Note
- Prefer batching and
materializeover using the fork operator. - Any two statements must be separated by a semicolon.
Examples
Name tabular results
The following query produces two tabular results. User agent tools can then display those results with the appropriate name associated with each (Count of events in Florida and Count of events in Guam, respectively).
StormEvents | where State == "FLORIDA" | count | as ['Count of events in Florida'];
StormEvents | where State == "GUAM" | count | as ['Count of events in Guam']
Share a calculation
Batching is useful for scenarios where a common calculation is shared by multiple subqueries, such as for dashboards. If the common calculation is complex, use the materialize() function and construct the query so that it will be executed only once:
let m = materialize(StormEvents | summarize n=count() by State);
m | where n > 2000;
m | where n < 10