Views
Views are virtual tables based on the result-set of a Kusto Query Language query. Just like a real table, a view contains rows and columns. Unlike a real table, a view doesn't hold its own data storage.
Views are defined through user-defined functions with the following requirements:
- The result of the function must be tabular (for example, it cannot be a scalar value).
- The function must take no arguments.
Views can be based on either stored functions or defined as part of the query using a let statement.
Note
Views are not technically schema entities. However, all functions that comply with the constraints above are regarded as views.
Example - define and use a view
The following query defines and uses a view. The view
is used as-if a table called T was defined (there's no need to reference the
function T using the function call syntax T()):
let T=() {print x=1, y=2};
T
Returns
| x | y |
|---|---|
| 1 | 2 |
The view keyword
By default, operators that support a wildcard syntax to specify table names will not reference views, even if the view's name matches the wildcard. An example of this type of operator is the union operator. In this case, use the view keyword to have the view
included as well.
Example - view keyword
For example, the results of the following query include the T1 view, but not T2:
let T1=view (){print Name="T1"};
let T2=(){print Name="T2"};
union T*