datatable operator

Learn how to use the datatable operator to define a table with given schema and data.

Returns a table whose schema and values are defined in the query itself.

Syntax

datatable( ColumnName : ColumnType [, …]) [ ScalarValue [, …] ]

Parameters

NameTypeRequiredDescription
ColumnNamestring✔️The name for a column.
ColumnTypestring✔️The type of data in the column.
ScalarValuescalar✔️The value to insert into the table. The total number of values must be a multiple of the number of columns in the table. Each value is assigned to a column based on its position. Specifically, the n’th value is assigned to the column at position n % NumColumns, where NumColumns is the total number of columns.

Returns

This operator returns a data table of the given schema and data.

Example

This example creates a table with Date, Event, and MoreData columns, filters rows with Event descriptions longer than 4 characters, and adds a new column key2 to each row from the MoreData dynamic object.

datatable(Date:datetime, Event:string, MoreData:dynamic) [
    datetime(1910-06-11), "Born", dynamic({"key1":"value1", "key2":"value2"}),
    datetime(1930-01-01), "Enters Ecole Navale", dynamic({"key1":"value3", "key2":"value4"}),
    datetime(1953-01-01), "Published first book", dynamic({"key1":"value5", "key2":"value6"}),
    datetime(1997-06-25), "Died", dynamic({"key1":"value7", "key2":"value8"}),
]
| where strlen(Event) > 4
| extend key2 = MoreData.key2

Output

DateEventMoreDatakey2
1930-01-01 00:00:00.0000000Enters Ecole Navale{
“key1”: “value3”,
“key2”: “value4”
}		value4
1953-01-01 00:00:00.0000000Published first book{
“key1”: “value5”,
“key2”: “value6”
}		value6