Is there a difference between view and tabular expression?

greatvovan 0
Viewed 28

Documentation for views defines syntax as follows:

let v=() {print x=1, y=2};

If I simplify it to

let te = print x=1, y=2;

it will be a variable holding a tabular expression.

I found that I can use them interchangeably, expressions work pretty much like (not materialized) views.

let te = print x = rand(1000), y = 1;
let v=() {print x = rand(1000), y = 1};
te | join v on y | join te on y | join v on y

Is there any performance or other difference between the above options? If no, why do two variants of syntax exist?

azure-data-explorer kql
1 Answers

You are taking a very specific use-case, of an ad-hoc function without parameters.
A use-case that does not show the true potential of the syntax.

Yes, they are all tabular expressions.

let t = range i from 1 to 3 step 1;
t
i
1
2
3

Fiddle

But, can they be constructed by using scalar parameters?

let t = (x:int, y:int){range i from x to y step 1};
t(4,7)
i
4
5
6
7

Fiddle

Or by operating on another tabular expression?

let t = (mytab:(x:int, y:int), j:int){mytab | extend z = (x + y) * j};
range i from 1 to 5 step 1
| extend x = toint(rand(10)), y = toint(rand(10))
| invoke t(1000)
i x y z
1 2 8 10000
2 6 8 14000
3 3 0 3000
4 2 6 8000
5 3 2 5000

Fiddle

Are they recognized by operators such as union?

let t1 = range i from 1 to 3 step 1;
let t2 = range i from 1 to 4 step 1;
let t3 = (){range i from 1 to 5 step 1};
let t4 = view(){range i from 1 to 6 step 1};
let t5 = view(){range i from 1 to 7 step 1};
union withsource=src t*
| summarize count() by src
src count_
t4 6
t5 7

Fiddle

or search?

let t1 = range i from 1 to 3 step 1;
let t2 = range i from 1 to 4 step 1;
let t3 = (){range i from 1 to 5 step 1};
let t4 = view(){range i from 1 to 6 step 1};
let t5 = view(){range i from 1 to 7 step 1};
search in (t*) *
| summarize count() by $table
$table count_
t4 6
t5 7

Fiddle

David דודו Markovitz0
Related