graph function

Learn how to use the graph function to reference a persisted graph entity for querying.

The graph function is an intrinsic function that enables querying of a persisted graph entity, similar to the cluster(), database(), external_table(), and table() functions. It supports retrieving either the most recent snapshot of the graph, a specific snapshot, or creating a transient graph from the model.

Permissions

To run this function, the user needs Database viewer permissions.

Syntax

graph( GraphName )

graph( GraphName , SnapshotName )

graph( GraphName , snapshot= SnapshotName )

graph( GraphName , Transient )

Parameters

NameTypeRequiredDescription
GraphNamestring✔️The name of the graph model to query.
SnapshotNamestringThe name of a specific snapshot to retrieve. If not specified, the most recent snapshot is used.
TransientboolIf true, creates a transient graph from the model (no snapshot is used). If false, uses the latest snapshot (same as omitting this parameter).

Returns

The graph function returns a graph and must be followed by a graph operator. The function retrieves the specified graph model name, either as:

  • The latest snapshot (default or when false is specified)
  • A specific named snapshot
  • A transient graph from the model (when true is specified)

Examples

Query the latest snapshot

The following example queries the most recent snapshot of a persisted graph named “SecurityGraph”:

graph("SecurityGraph")
| graph-match (user)-[permission]->(resource)
  where user.type == "User" and resource.type == "Database"
  project UserName = user.name, ResourceName = resource.name, Permission = permission.type

Query a specific snapshot

The following example queries a specific snapshot of the graph:

graph("SecurityGraph", "Snapshot_2025_05_01")
| graph-match (attacker)-[attacks]->(target)-[connects]->(system)
  where attacker.name == "MaliciousActor"
  project Attacker = attacker.name, Target = target.name, System = system.name

Query with named parameter syntax

The following example uses the named parameter syntax to specify a snapshot:

graph("SecurityGraph", snapshot="Snapshot_2025_05_01")
| graph-shortest-paths (start)-[e*1..20]->(end)
  where start.name == "Alice" and end.name == "Database"
  project PathLength = array_length(e), Path = e

Create a transient graph from the model

The following example creates a transient graph from the model, similar to the make-graph operator:

graph("SecurityGraph", true)
| graph-match (user)-[permission]->(resource)
  where user.type == "User" and resource.type == "Database"
  project UserName = user.name, ResourceName = resource.name, Permission = permission.type

Use false to specify latest snapshot

The following example explicitly specifies false to use the latest snapshot, which is equivalent to omitting the second parameter:

graph("SecurityGraph", false)
| graph-match (user)-[permission]->(resource)
  where user.type == "User" and resource.type == "Database"
  project UserName = user.name, ResourceName = resource.name, Permission = permission.type

Related content