Scalar Functions
Introduction to Scalar Functions Scalar function overview and categories
Scalar functions take one or more values and return a single value. Use them in project, extend, and where expressions to transform or compute values per row:
logs | extend hour = hourofday ($ time ), msg = tolower (body) | where strlen (msg) > 100 For a full introduction to writing queries, see Writing Queries .
Function Description contains Indicate whether a string contains another string (case-insensitive). contains_cs Indicate whether a string contains another string (case-sensitive). countof Counts occurrences of a substring in a string. endswith Indicate whether a string ends with another string (case-insensitive). endswith_cs Indicate whether a string ends with another string (case-sensitive). extract Extracts a match for a regular expression from a string. extract_all Extracts all matches for a regular expression from a string. has Indicate whether a string contains a whole word (case-insensitive, word boundary matching). has_any_index Returns the index of the first matching value in the source string. has_cs Indicate whether a string contains a whole word (case-sensitive, word boundary matching). hasprefix Indicate whether a string starts with a word prefix (case-insensitive, word boundary matching). hasprefix_cs Indicate whether a string starts with a word prefix (case-sensitive, word boundary matching). hassuffix Indicate whether a string ends with a word suffix (case-insensitive, word boundary matching). hassuffix_cs Indicate whether a string ends with a word suffix (case-sensitive, word boundary matching). indexof Returns the zero-based index of the first occurrence of a substring. matches regex Returns true if the string matches the regular expression pattern. parse_url Parses a URL string and returns a dynamic object with URL components. parse_urlquery Parses a URL query string and returns a dynamic object. parse_version Converts a version string to a comparable decimal number. replace_regex Replaces all regex matches with another string. replace_string Replaces all occurrences of a string with another string. replace_strings Replaces multiple string pairs in the source. reverse Reverses the input string. split Splits a string by a delimiter and returns an array. startswith Indicate whether a string starts with another string (case-insensitive). startswith_cs Indicate whether a string starts with another string (case-sensitive). strcat Concatenates between 1 and 64 arguments. strcat_array Concatenates array elements into a string using the specified delimiter. strcat_delim Concatenates strings with a delimiter. strcmp Compares two strings and returns -1, 0, or 1. strlen Returns the length of the input string in characters. strrep Repeats a string a specified number of times. substring Extracts a substring from the source string starting at the specified position. tolower Converts a string to lower case. toupper Converts a string to upper case. translate Replaces characters in a string based on character mapping. trim Removes leading and trailing match of the specified regex from the source string. trim_end Removes trailing match of the specified regex from the source string. trim_start Removes leading match of the specified regex from the source string. url_decode URL-decodes a string. url_encode URL-encodes a string.
Function Description array_length Return the number of elements in an array. bag_keys Returns an array of all the keys in a property bag (dynamic object). bag_pack Create a property bag (dynamic object) from key-value pairs. bag_remove_keys Remove specified keys from a property bag. extract_dynamic Extract a value from a dynamic value using a JSONPath expression. extract_json Extract a value from a JSON string using a JSONPath expression. pack_all Create a property bag containing all column values. parse_json Parse a JSON string into a dynamic value. range Generates an array of values in a specified range.
Function Description abs Returns the absolute value of a numeric expression, preserving the input type. acos Returns the arc cosine of the input (in radians). asin Returns the arc sine of the input (in radians). atan Returns the arc tangent of the input (in radians). atan2 Returns the angle (in radians) between the positive x-axis and the point (x, y). bin Round values down to a bin of a given bin size. bin_at Round values down to a bin of a given size relative to a fixpoint. bin_auto Automatically bins datetime values into human-friendly intervals based on the query time range. ceiling Calculates the smallest integer greater than, or equal to, the specified numeric expression. cos Returns the cosine of the input angle in radians. cot Returns the cotangent of the input angle in radians. degrees Converts radians to degrees. exp Returns e raised to the power of the numeric expression. exp10 Returns 10 raised to the power of the numeric expression. exp2 Returns 2 raised to the power of the numeric expression. floor Rounds values down to a fixed-size bin. isfinite Returns whether the input is a finite value (not infinity and not NaN). isinf Returns whether the input is an infinite value (positive or negative infinity). isnan Returns whether the input is NaN (Not a Number). log Returns the natural logarithm of the numeric expression. log10 Returns the base-10 logarithm of the numeric expression. log2 Returns the base-2 logarithm of the numeric expression. pow Returns the value raised to the specified power. radians Converts degrees to radians. round Returns the rounded number to the specified precision. sign Returns the sign of a numeric expression (-1, 0, or 1), preserving the input type. sin Returns the sine of the input angle in radians. sqrt Returns the square root of the numeric expression. tan Returns the tangent of the input angle in radians.
Function Description estimate_data_size Estimates the data size in bytes for the specified columns. isempty Returns true if the argument is an empty string or is null. isnotempty Returns true if the argument is not an empty string and is not null. isnotnull Returns true if the value is not null. isnull Returns true if the value is null. new_guid Returns a random GUID string. to_numeric Extract numeric value from dynamic or pass through numeric types. tobool Convert the input to a boolean. todouble Convert the input to a floating point number. toguid Validates and normalizes a string as a GUID. tohex Converts a number to a hexadecimal string. toint Convert the input to a 32-bit integer. tolong Convert the input to a 64-bit integer. tostring Convert the input to a string.
Function Description parse_ipv4 Converts an IPv4 string to a long number. parse_ipv4_mask Converts an IPv4 string and netmask to a long number. parse_ipv6 Converts an IPv6 string to a canonical string representation. parse_ipv6_mask Converts an IPv6 string and netmask to a canonical string representation.
Function Description series_abs Calculates the absolute value of each element in a numeric series. series_add Element-wise addition of two numeric series. series_avg Returns the average (mean) of all elements in a numeric series, ignoring null values. series_ceiling Rounds each element up to the nearest integer. series_decompose_anomalies Detects anomalies in a time series using decomposition and outlier detection. series_divide Element-wise division of two numeric series. series_equals Element-wise equality comparison of two series. series_exp Calculates the exponential (e^x) of each element. series_fft Compute the Fast Fourier Transform of a series. series_fill_backward Fills missing values in a series by propagating the next valid value backward. series_fill_const Fills missing values in a series with a constant value. series_fill_forward Fills missing values in a series by propagating the previous valid value forward. series_fill_linear Fills missing values in a series using linear interpolation. series_fir Applies a Finite Impulse Response (FIR) filter to a series. series_fit_2lines Fit two lines (piecewise linear) to the series. series_fit_line Fit a line to the series using linear regression. series_fit_poly Applies polynomial regression to a series, fitting a curve of the specified degree. series_floor Rounds each element down to the nearest integer. series_greater Element-wise greater-than comparison of two series. series_greater_equals Element-wise greater-than-or-equal comparison of two series. series_ifft Compute the Inverse Fast Fourier Transform. series_iir Applies an Infinite Impulse Response (IIR) filter to a series. series_less Element-wise less-than comparison of two series. series_less_equals Element-wise less-than-or-equal comparison of two series. series_log Calculates the natural logarithm of each element. series_max Returns the maximum value in a numeric series, ignoring null values. series_min Returns the minimum value in a numeric series, ignoring null values. series_multiply Element-wise multiplication of two numeric series. series_not_equals Element-wise inequality comparison of two series. series_outliers Detects outliers in a series using the Tukey fence method. series_pearson_correlation Calculate the Pearson correlation coefficient between two series. series_periods_detect Detects periodic patterns in a time series using FFT-based spectral analysis. series_periods_validate Validates expected periods in a time series using FFT spectral analysis. series_pow Element-wise power operation (base^exponent) of two numeric series. series_seasonal Calculates the seasonal component of a series using median of values at same phase. series_sign Returns the sign of each element (-1 for negative, 0 for zero, 1 for positive). series_stats Computes statistics (min, max, avg, stdev, variance) for a numeric series. series_stats_dynamic Computes statistics for a numeric series and returns as a property bag. series_stdev Returns the population standard deviation of all elements in a numeric series, ignoring null values. series_subtract Element-wise subtraction of two numeric series. series_sum Returns the sum of all elements in a numeric series, ignoring null values.
Function Description case Evaluates predicates in order and returns the first matching value. coalesce Returns the first non-empty value (not null and not empty string). iff Evaluates the predicate and returns value_if_true or value_if_false.
Function Description extract_log_template Normalizes a string into a structural template by replacing variable tokens (numbers, UUIDs, IPs, hex values, quoted strings) with typed placeholders. log_template_hash Computes a hash of the structural log template, for grouping similar logs without allocating the template string. log_template_regex Generates a regex pattern that matches log lines with the same structural template.
Function Description current_table Returns the table name for the current row. dcount_hll Calculate the distinct count from an HLL representation. percentile_tdigest Calculate the percentile from a t-digest representation. row_number Returns the current row number in the serialized row set.