Forum Discussion
Get scalar value from table
- Sep 20, 2017
Tim,
You're looking for toscalar(). For a slightly more advanced example of how to use it (together with makeset() and in()), check out the last section of our aggregations tutorial.
To pseudocode your example, you'd be looking at something like:
let myDateTime = toscalar(Table1 | summarize max(TimeGenerated));
Table 2
| where TimeGenerated between ((myDateTime - 5m) .. (myDateTime + 5m))
| ...
Tim,
You're looking for toscalar(). For a slightly more advanced example of how to use it (together with makeset() and in()), check out the last section of our aggregations tutorial.
To pseudocode your example, you'd be looking at something like:
let myDateTime = toscalar(Table1 | summarize max(TimeGenerated));
Table 2
| where TimeGenerated between ((myDateTime - 5m) .. (myDateTime + 5m))
| ...
Evgeny,
Perfect. Thanks. I knew there was something like that in there somewhere, but I was having trouble finding it in the language reference. I see it now under Scalar Functions.