hash()

Applies to: ✅ Azure Data ExplorerAzure MonitorMicrosoft Sentinel

Returns a hash value for the input value.

Note

  • The function calculates hashes using the xxhash64 algorithm, but this may change. It's recommended to only use this function within a single query.
  • If you need to persist a combined hash, it's recommended to use hash_sha256(), hash_sha1(), or hash_md5() and combine the hashes with a bitwise operator. These functions are more complex to calculate than hash().

Syntax

hash(source [, mod])

Learn more about syntax conventions.

Parameters

Name Type Required Description
source scalar ✔️ The value to be hashed.
mod int A modulo value to be applied to the hash result, so that the output value is between 0 and mod - 1. This parameter is useful for limiting the range of possible output values or for compressing the output of the hash function into a smaller range.

Returns

The hash value of source. If mod is specified, the function returns the hash value modulo the value of mod, meaning that the output of the function will be the remainder of the hash value divided by mod. The output will be a value between 0 and mod - 1, inclusive.

Examples

String input

print result=hash("World")
result
1846988464401551951

String input with mod

print result=hash("World", 100)
result
51

Datetime input

print result=hash(datetime("2015-01-01"))
result
1380966698541616202

Use hash to check data distribution

Use the hash() function for sampling data if the values in one of its columns is uniformly distributed. In the following example, StartTime values are uniformly distributed and the function is used to run a query on 10% of the data.

StormEvents 
| where hash(StartTime, 10) == 0
| summarize StormCount = count(), TypeOfStorms = dcount(EventType) by State 
| top 5 by StormCount desc