table()

Learn how to use the table() function to reference a table.

The table() function references a table by providing its name as an expression of type string.

Syntax

table( TableName [, DataScope] )

Parameters

NameTypeRequiredDescription
TableNamestring✔️The name of the table being referenced. The value of this expression must be constant at the point of call to the function, meaning it cannot vary by the data context.
DataScopestringUsed to restrict the table reference to data according to how this data falls under the table’s effective cache policy. If used, the actual argument must be one of the Valid data scope values.

Valid data scope values

ValueDescription
hotcacheOnly data that is categorized as hot cache will be referenced.
allAll the data in the table will be referenced.
defaultThe default is all, except if it has been set to hotcache by the cluster admin.

Returns

table(T) returns:

  • Data from table T if a table named T exists.
  • Data returned by function T if a table named T doesn’t exist but a function named T exists. Function T must take no arguments and must return a tabular result.
  • A semantic error is raised if there’s no table named T and no function named T.

Examples

Use table() to access table of the current database

table('StormEvents') | count

Output

Count
59066

Use table() inside let statements

The query above can be rewritten as a query-defined function (let statement) that receives a parameter tableName - which is passed into the table() function.

let foo = (tableName:string)
{
    table(tableName) | count
};
foo('StormEvents')

Output

Count
59066

Use table() inside Functions

The same query as above can be rewritten to be used in a function that receives a parameter tableName - which is passed into the table() function.

.create function foo(tableName:string)
{
    table(tableName) | count
};

Use table() with non-constant parameter

A parameter, which isn’t a scalar constant string, can’t be passed as a parameter to the table() function.

Below, given an example of workaround for such case.

let T1 = print x=1;
let T2 = print x=2;
let _choose = (_selector:string)
{
    union
    (T1 | where _selector == 'T1'),
    (T2 | where _selector == 'T2')
};
_choose('T2')

Output

x
2