datatable operator

Returns a table whose schema and values are defined in the query itself.

Note

This operator doesn't have a pipeline input.

Syntax

datatable ( ColumnName : ColumnType [, ...] ) [ ScalarValue [, ScalarValue ...] ]

Arguments

• ColumnName, ColumnType: These arguments define the schema of the table. The arguments use the same syntax as used when defining a table. For more information, see .create table).
• ScalarValue: A constant scalar value to insert into the table. The number of values must be an integer multiple of the columns in the table. The n'th value must have a type that corresponds to column n % NumColumns.

• ColumnName, ColumnType: These arguments define the schema of the table.
• ScalarValue: A constant scalar value to insert into the table. The number of values must be an integer multiple of the columns in the table. The n'th value must have a type that corresponds to column n % NumColumns.

Returns

This operator returns a data table of the given schema and data.

Example

datatable(Date:datetime, Event:string, MoreData:dynamic) [
    datetime(1910-06-11), "Born", dynamic({"key1":"value1", "key2":"value2"}),
    datetime(1930-01-01), "Enters Ecole Navale", dynamic({"key1":"value3", "key2":"value4"}),
    datetime(1953-01-01), "Published first book", dynamic({"key1":"value5", "key2":"value6"}),
    datetime(1997-06-25), "Died", dynamic({"key1":"value7", "key2":"value8"}),
]
| where strlen(Event) > 4
| extend key2 = MoreData.key2

Result:

Date	Event	MoreData	key2
1930-01-01 00:00:00.0000000	Enters Ecole Navale	{ "key1": "value3", "key2": "value4" }	value4
1953-01-01 00:00:00.0000000	Published first book	{ "key1": "value5", "key2": "value6" }	value6