stored_query_result()

Applies to: ✅ Azure Data ExplorerAzure MonitorMicrosoft Sentinel

Retrieves a previously created stored query result.

To set a stored query result, see .set stored_query_result command.

Syntax

stored_query_result( StoredQueryResultName )

Learn more about syntax conventions.

Parameters

Name Type Required Description
StoredQueryResultName string ✔️ The name of the stored query result.

Examples

References the stored query result named Numbers.

stored_query_result("Numbers")

Output

X
1
2
3
...

Pagination

The following example retrieves clicks by Ad network and day, for the last seven days:

.set stored_query_result DailyClicksByAdNetwork7Days with (previewCount = 100) <|
Events
| where Timestamp > ago(7d)
| where EventType == 'click'
| summarize Count=count() by Day=bin(Timestamp, 1d), AdNetwork
| order by Count desc
| project Num=row_number(), Day, AdNetwork, Count

Output

Num Day AdNetwork Count
1 2020-01-01 00:00:00.0000000 NeoAds 1002
2 2020-01-01 00:00:00.0000000 HighHorizons 543
3 2020-01-01 00:00:00.0000000 PieAds 379
... ... ... ...

Retrieve the next page:

stored_query_result("DailyClicksByAdNetwork7Days")
| where Num between(100 .. 200)

Output

Num Day AdNetwork Count
100 2020-01-01 00:00:00.0000000 CoolAds 301
101 2020-01-01 00:00:00.0000000 DreamAds 254
102 2020-01-02 00:00:00.0000000 SuperAds 123
... ... ... ...