case()

Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Evaluates a list of predicates and returns the first result expression whose predicate is satisfied.

If none of the predicates return true, the result of the else expression is returned. All predicate arguments must be expressions that evaluate to a boolean value. All then arguments and the else argument must be of the same type.

Syntax

case(predicate_1, then_1, [predicate_2, then_2, ...] else)

Learn more about syntax conventions.

Parameters

Name	Type	Required	Description
predicate	string	✔️	An expression that evaluates to a boolean value.
then	string	✔️	An expression that gets evaluated and its value is returned from the function if predicate is the first predicate that evaluates to true.
else	string	✔️	An expression that gets evaluated and its value is returned from the function if neither of the predicate_i evaluate to true.

Returns

The value of the first then_i whose predicate_i evaluates to true, or the value of else if neither of the predicates are satisfied.

Example

Run the query

range Size from 1 to 15 step 2
| extend bucket = case(Size <= 3, "Small", 
                       Size <= 10, "Medium", 
                       "Large")

Output

Size	bucket
1	Small
3	Small
5	Medium
7	Medium
9	Medium
11	Large
13	Large
15	Large