Returns a scalar constant value of the evaluated expression.
This function is useful for queries that require staged calculations, as for example calculating a total count of events and then use it for for filtering groups that exceed certain percent of all events.
- Expression: Expression that will be evaluated for scalar conversion
A scalar constant value of the evaluated expression. If expression result is a tabular, then the first column and first row will be taken for conversion.
You can use a let statement for readability of the query when using
toscalar() can be calculated a constant number of times during the query execution.
In other words,
toscalar() function cannot be applied on row-level of (for-each-row scenario).
The following query evaluates
Step as scalar constants - and
use it for
let Start = toscalar(print x=1); let End = toscalar(range x from 1 to 9 step 1 | count); let Step = toscalar(2); range z from Start to End step Step | extend start=Start, end=End, step=Step