I have a query like:

customers
|order by updateTime desc
| project id,updateTime,name,updated,status
| take 1

Which returns several columns, including status column being String. This field can be Null or with some status info.

Let tempStatus= Status | where id='1'| project status

I want to set the query from Customer table to return latest row and if the status column is empty, then replace it with my tempStatus. How do I do this? I tried iif but it's not letting me inside the query..

Anyone can help?

I have a query like:

customers
|order by updateTime desc
| project id,updateTime,name,updated,status
| take 1

Which returns several columns, including status column being String. This field can be Null or with some status info.

Let tempStatus= Status | where id='1'| project status

I want to set the query from Customer table to return latest row and if the status column is empty, then replace it with my tempStatus. How do I do this? I tried iif but it's not letting me inside the query..

Anyone can help?

• azure
• kql

• could you please share what you have tried – Balaji Commented Mar 26 at 2:33

2 Answers 2

Adding to @Yoni L.'s answer, you can also try the below KQL query which shown as below:

let tempStatus = datatable(id: string, status: string)
[
    "8", "Active"
];
let RithCustomer = datatable(id: string, updateTime: datetime, name: string, updated: string, status: string)
[
    "8", datetime(2025-03-25 10:00:00), "Rithwik", "Yes", "",
    "7", datetime(2025-03-24 15:30:00), "Bojja", "No", "Inactive"
];
RithCustomer
| order by updateTime desc
| extend teststatus = toscalar(tempStatus | where id == "8" | project status)
| project id, updateTime, name, updated, status = iff(status == "", teststatus, status)
| take 1

Output:

Fiddle.

Try using the coalesce() function