iff()

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Returns the then value when the if condition evaluates to true, otherwise it returns the else value.

The iff() and iif() functions are equivalent.

Syntax

iff(if, then, else)

Learn more about syntax conventions.

Parameters

Name Type Required Description
if string ✔️ An expression that evaluates to a boolean value.
then scalar ✔️ An expression that returns its value when the if condition evaluates to true.
else scalar ✔️ An expression that returns its value when the if condition evaluates to false.

Returns

This function returns the then value when the if condition evaluates to true, otherwise it returns the else value.

Example

StormEvents
| extend Rain = iff((EventType in ("Heavy Rain", "Flash Flood", "Flood")), "Rain event", "Not rain event")
| project State, EventId, EventType, Rain

Output

The following table shows only the first five rows.

State EventId EventType Rain
ATLANTIC SOUTH 61032 Waterspout Not rain event
FLORIDA 60904 Heavy Rain Rain event
FLORIDA 60913 Tornado Not rain event
GEORGIA 64588 Thunderstorm Wind Not rain event
MISSISSIPPI 68796 Thunderstorm Wind Not rain event
... ... ... ...