Types
Introduction to Types
KQL scalar types overview
Every value in KQL has a scalar type. Types determine which operators and functions can be applied to a value.
Scalar Types
| Type | Description | Example literals |
|---|---|---|
bool | True or false | true, false |
int | 32-bit signed integer | 42, -1 |
long | 64-bit signed integer | 100000000000 |
real | 64-bit floating point | 3.14, 1e10 |
decimal | 128-bit high-precision number | decimal(1.23456789) |
string | UTF-8 text | "hello", 'world' |
datetime | Point in time (UTC) | datetime(2026-03-11) |
timespan | Duration | timespan(1d), 5m, 2h |
guid | Globally unique identifier | guid(...) |
dynamic | JSON-like value (array, object, or scalar) | dynamic([1, 2]), dynamic({"a": 1}) |
Null
Most scalar types have a null value representing missing or unknown data. Null propagates through expressions: any arithmetic or comparison involving null produces null.
T | where isnull(value)
T | extend result = iif(isnull(x), "missing", tostring(x))The string type is an exception — see Strings and Null for details.
Type Conversions
Use type conversion functions to convert between types:
T | extend n = toint("42")
T | extend t = todatetime("2026-03-11")
T | extend s = tostring(42)See Scalar Functions for the full list of conversion functions.
Type Classes
Some functions and operators work with any type that has certain capabilities. A type class is a group of types that share a common behavior — for example, ordered groups all types that can be compared and sorted.