Stored functions

Applies to: ✅ Azure Data ExplorerAzure MonitorMicrosoft Sentinel

Functions are reusable queries or query parts. Functions can be stored as database entities, similar to tables, called stored functions. Alternatively, functions can be created in an ad-hoc fashion with a let statement, called query-defined functions. For more information, see user-defined functions.

To create and manage stored functions, see the Stored functions management overview.

Note

For the function to participate in search * and union * scenarios, define the stored function as a view.

For more information on working with functions in Log Analytics, see Functions in Azure Monitor log queries.