buildschema() (aggregation function)

  • Article
  • 05/23/2025

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Builds the minimal schema that admits all values of DynamicExpr.

Note

This function is used in conjunction with the summarize operator.

Syntax

buildschema (DynamicExpr)

Learn more about syntax conventions.

Parameters

Name Type Required Description
DynamicExpr dynamic ✔️ Expression used for the aggregation calculation.

Returns

Returns the minimal schema that admits all values of DynamicExpr.

Tip

If the input is a JSON string, use the parse_json() function to convert the JSON to a dynamic value. Otherwise, an error might occur.

Example

The following example builds a schema based on:

  • {"x":1, "y":3.5}
  • {"x":"somevalue", "z":[1, 2, 3]}
  • {"y":{"w":"zzz"}, "t":["aa", "bb"], "z":["foo"]}

Run the query

datatable(value: dynamic) [
    dynamic({"x":1, "y":3.5}),
    dynamic({"x":"somevalue", "z":[1, 2, 3]}),
    dynamic({"y":{"w":"zzz"}, "t":["aa", "bb"], "z":["foo"]})
]
| summarize buildschema(value)

Results

schema_value
{"x":["long","string"],"y":["double",{"w":"string"}],"z":{"indexer":["long","string"]},"t":{"indexer":"string"}}

Schema breakdown

In the resulting schema:

  • The root object is a container with four properties named x, y, z, and t.
  • Property x is either type long or type string.
  • Property y is either type double or another container with a property w of type string.
  • Property z is an array, indicated by the indexer keyword, where each item can be either type long or type string.
  • Property t is an array, indicated by the indexer keyword, where each item is a string.
  • Every property is implicitly optional, and any array might be empty.

Related content