Returns a scalar constant value of the evaluated expression.
This function is useful for queries that require staged calculations. For example, calculate a total count of events, and then use the result to filter groups that exceed a certain percent of all events.
Any two statements must be separated by a semicolon.
- Expression: Expression that will be evaluated for scalar conversion.
A scalar constant value of the evaluated expression. If the result is a tabular, then the first column and first row will be taken for conversion.
toscalar() can't be applied on a scenario that applies the function on each row. This is because the function can only be calculated a constant number of times during the query execution. Usually, when this limitation is hit, the
following error will be returned:
can't use '<column name>' as it is defined outside its row-context scope.
This example using tscalar returns the singular event count
events | project original_time | where original_time > ago(5d) | extend SingularCount = toscalar(events | where original_time > ago(5d) | count) | project SingularCount
|original_time |count() | |---------------------------|--------| |2023-07-19T11:43:28.722Z |55601 |
A similar result can using summarize and max funtionality.
events | project original_time | where original_time > ago(5d) | summarize AggregatedCount=count()
|count() | |--------| |55601 |