Expressions and Variables

String equality

Use =~ for case-insensitive string equality and !~ for case-insensitive inequality. Comparisons use ordinal, culture-independent casing, including Unicode. Empty strings are valid values; comparisons involving a null produce no match in where. Both operands must be strings. == and != remain case-sensitive.

ApplicationLogs
| where Level =~ "error"
| where Service !~ "healthcheck"

Variables

You can define expressions to break queries into smaller, more manageable pieces.

Take this one for example, here we define variables, and use them in our datatable expression.

let name = "abc";
let value = 1;
datatable (name: string, value: int64) [
    name, value
]

Output:

You can do the same thing to table valued expressions, which will enable you to assemble complex queries.

let name = "abc";
let value = 1;
let table1 = datatable (name: string, value: int64)
[
    name, value,
    name + "1", value * 2,
    name + "2", value * 3,
    name + "3", value * 4
]
table1
| union(table1)

Output: