case()

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Evaluates a list of predicates and returns the first result expression whose predicate is satisfied.

If none of the predicates return true, the result of the else expression is returned. All predicate arguments must be expressions that evaluate to a boolean value. All then arguments and the else argument must be of the same type.

Syntax

case(predicate_1, then_1, [predicate_2, then_2, ...] else)

Learn more about syntax conventions.

Parameters

Name Type Required Description
predicate string ✔️ An expression that evaluates to a boolean value.
then string ✔️ An expression that gets evaluated and its value is returned from the function if predicate is the first predicate that evaluates to true.
else string ✔️ An expression that gets evaluated and its value is returned from the function if neither of the predicate_i evaluate to true.

Returns

The value of the first then_i whose predicate_i evaluates to true, or the value of else if neither of the predicates are satisfied.

Example

range Size from 1 to 15 step 2
| extend bucket = case(Size <= 3, "Small", 
                       Size <= 10, "Medium", 
                       "Large")

Output

Size bucket
1 Small
3 Small
5 Medium
7 Medium
9 Medium
11 Large
13 Large
15 Large