Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Functions are reusable queries or query parts. Functions can be stored as database entities, similar to tables, called stored functions. Alternatively, functions can be created in an ad-hoc fashion with a let statement, called query-defined functions. You can use all standard query operators in the function body, such as the in operator for filtering based on a set of values. For more information, see user-defined functions and invoke operator.
To create and manage stored functions, see the Stored functions management overview.
Note
For the function to participate in search * and union * scenarios, define the stored function as a view.
For more information on working with functions in Log Analytics, see Functions in Azure Monitor log queries.