table()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

The table() function references a table by providing its name as an expression of type string.

Syntax

table( TableName [, DataScope] )

Learn more about syntax conventions.

Parameters

Name	Type	Required	Description
TableName	string	✔️	The name of the table being referenced. The value of this expression must be constant at the point of call to the function, meaning it cannot vary by the data context.
DataScope	string		Used to restrict the table reference to data according to how this data falls under the table's effective cache policy. If used, the actual argument must be one of the Valid data scope values.

Valid data scope values

Value	Description
hotcache	Only data that is categorized as hot cache will be referenced.
all	All the data in the table will be referenced.
default	The default is all, except if it has been set to hotcache by the cluster admin.

Returns

table(T) returns:

• Data from table T if a table named T exists.
• Data returned by function T if a table named T doesn't exist but a function named T exists. Function T must take no arguments and must return a tabular result.
• A semantic error is raised if there's no table named T and no function named T.

Examples

Use table() to access table of the current database

table('StormEvents') | count

Output

Count
59066

Use table() inside let statements

The query above can be rewritten as a query-defined function (let statement) that receives a parameter tableName - which is passed into the table() function.

let foo = (tableName:string)
{
    table(tableName) | count
};
foo('StormEvents')

Output

Count
59066

Use table() inside Functions

The same query as above can be rewritten to be used in a function that receives a parameter tableName - which is passed into the table() function.

.create function foo(tableName:string)
{
    table(tableName) | count
};

Use table() with non-constant parameter

A parameter, which isn't a scalar constant string, can't be passed as a parameter to the table() function.

Below, given an example of workaround for such case.

let T1 = print x=1;
let T2 = print x=2;
let _choose = (_selector:string)
{
    union
    (T1 | where _selector == 'T1'),
    (T2 | where _selector == 'T2')
};
_choose('T2')

Output

x
2