Tables

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Tables are named entities that hold data. A table has an ordered set of columns, and zero or more rows of data. Each row holds one data value for each of the columns of the table. The order of rows in the table is unknown, and doesn't in general affect queries, except for some tabular operators (such as the top operator) that are inherently undetermined. For information on how to create and manage tables, see managing tables.

Tables occupy the same namespace as stored functions. If a stored function and a table both have the same name, the stored function will be chosen.

Note

  • The maximum limit of tables per database is 10,000.
  • Table names are case-sensitive. For more information, see Identifier naming rules.

References tables in queries

The simplest way to reference a table is by using its name. This reference can be done for all tables that are in the database in context. For example, the following query counts the records of the current database's StormEvents table:

StormEvents
| count

An equivalent way to write the query above is by escaping the table name:

["StormEvents"]
| count

Tables may also be referenced by explicitly noting the database they are in. Then you can author queries that combine data from multiple databases. For example, the following query will work with any database in context, as long as the caller has access to the target database:

cluster("https://help.chinaeast2.kusto.chinacloudapi.cn").database("Samples").StormEvents
| count

It's also possible to reference a table by using the table() special function, as long as the argument to that function evaluates to a constant. For example:

let counter=(TableName:string) { table(TableName) | count };
counter("StormEvents")

Note

Use the table() special function to explicitly specify the table data scope. For example, use this function to restrict processing to the data in the table that falls in the hot cache.

Related content