count operator

Syntax

T | count

Arguments

T: The tabular data whose records are to be counted.

Returns

This function returns a table with a single record and column of type long. The value of the only cell is the number of records in T.

Example

This example simple counts the number of events over the last 24h. By projecting only the original_time column, and searching for a specific timespan this is a relatively inexpensive query.

events 
    | project original_time=unixtime_milliseconds_todatetime(original_time)
    | where original_time > ago(24h)
    | count