invoke operator

  • Article
  • 09/30/2024

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Invokes a lambda expression that receives the source of invoke as a tabular argument.

Note

For more information on how to declare lambda expressions that can accept tabular arguments, see let statements.

Syntax

T | invoke function([param1, param2])

Learn more about syntax conventions.

Parameters

Name Type Required Description
T string ✔️ The tabular source.
function string ✔️ The name of the lambda let expression or stored function name to be evaluated.
param1, param2 ... string Any additional lambda arguments to pass to the function.

Returns

Returns the result of the evaluated expression.

Example

The following example shows how to use the invoke operator to call lambda let expression:

Run the query

// clipped_average(): calculates percentiles limits, and then makes another 
//                    pass over the data to calculate average with values inside the percentiles
let clipped_average = (T:(x: long), lowPercentile:double, upPercentile:double)
{
   let high = toscalar(T | summarize percentiles(x, upPercentile));
   let low = toscalar(T | summarize percentiles(x, lowPercentile));
   T 
   | where x > low and x < high
   | summarize avg(x) 
};
range x from 1 to 100 step 1
| invoke clipped_average(5, 99)

Output

avg_x
52