Contribute in GitHub:

toscalar()

Returns a scalar constant value of the evaluated expression.

This function is useful for queries that require staged calculations. For example, calculate a total count of events, and then use the result to filter groups that exceed a certain percent of all events.

Any two statements must be separated by a semicolon.

Syntax

toscalar(Expression)

Arguments

Expression: Expression that will be evaluated for scalar conversion.

Returns

A scalar constant value of the evaluated expression. If the result is a tabular, then the first column and first row will be taken for conversion.

Limitations

toscalar() can't be applied on a scenario that applies the function on each row. This is because the function can only be calculated a constant number of times during the query execution. Usually, when this limitation is hit, the following error will be returned: can't use '<column name>' as it is defined outside its row-context scope.

Example

This example using tscalar returns the singular event count

    events
        | project original_time
        | where original_time > ago(5d)
        | extend SingularCount = toscalar(events | where original_time > ago(5d) | count)
        | project SingularCount

Results

|original_time              |count() |
|---------------------------|--------|
|2023-07-19T11:43:28.722Z   |55601   |

A similar result can using summarize and max funtionality.

    events
        | project original_time
        | where original_time > ago(5d)
        | summarize AggregatedCount=count()

Results

|count() |
|--------|
|55601   |