Scalar functions

Conditional functions

case()

Evaluates a list of conditions and returns the first result whose condition is satisfied.

Arguments

• condition: An expression that evaluates to a Boolean.
• result: An expression that Axiom evaluates and returns the value if its condition is the first that evaluates to true.
• nothingMatchedResult: An expression that Axiom evaluates and returns the value if none of the conditional expressions evaluates to true.

Returns

Axiom returns the value of the first result whose condition evaluates to true. If none of the conditions is satisfied, Axiom returns the value of nothingMatchedResult.

Example

case(condition1, result1, condition2, result2, condition3, result3, ..., nothingMatchedResult)

['sample-http-logs'] |
extend status_human_readable = case(
    status_int == 200,
    'OK',
    status_int == 201,
    'Created',
    status_int == 301,
    'Moved Permanently',
    status_int == 500,
    'Internal Server Error',
    'Other'
)

iff()

Evaluates the first argument (the predicate), and returns the value of either the second or third arguments. The second and third arguments must be of the same type.

Arguments

• predicate: An expression that evaluates to a boolean value.
• ifTrue: An expression that gets evaluated and its value returned from the function if predicate evaluates to true.
• ifFalse: An expression that gets evaluated and its value returned from the function if predicate evaluates to false.

Returns

This function returns the value of ifTrue if predicate evaluates to true, or the value of ifFalse otherwise.

Examples

iff(predicate, ifTrue, ifFalse)

['sample-http-logs']
| project Status = iff(req_duration_ms == 1, "numeric", "Inactive")