> For the complete documentation index, see [llms.txt](https://digitalgarden.batamladen.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://digitalgarden.batamladen.com/notes/query-languages/kql/data-types.md).
# Data Types
#### getschema
You can use this commmand piped at the end of any table to see the table schema.
```kql
VMComputer
| getschema
```
#### List of KQL datatypes
* Bool
* Datetime
* Dynamec
* GUID
* Int
* Long
* Real
* String
* Timespan
* Decimal
***
#### Bool
Field that has either Yes No or null value.
#### Datetime
Represents an instance of time. It represents data + time but can display only date or only time as well. UTC is default timezone.
#### Decimal
128bit lenght decimal number.
Slower procesing time for this datatype than regular number.
#### Dynamic
dynamic in KQL is a flexible data type that can store **JSON-like data** instead of a single value.
```kql
let x = dynamic({
"Name": "Mladen",
"Age": 25,
"Skills": ["KQL", "Sentinel"]
});
```
You can than access the values liek this:
```
x.Name
x.Skills[0]
```
Dynamic datatype is heavy, and does not work with some operators.
#### GUID
Not common, global unique identifier.
Ussualy a unique string datatype.
#### Int
Integeer
32bits and represent a whole number. No decimals
#### Long
64bits in size. not used that much only in special situation.
#### Real
64bits in size, but allow for a decimal point and more ised than a decimal type.
#### String
Mostu used datatype. Sequence of unicode chars.
Is btw brackets. Can contain kletters, numbers and symbols
Special chars ( / )
if you want to notate someone, you can use a slash before the quotes so that the quotes print as well.
```kql
print("John said /'KQL is cool/'!")
```
#### Timespan
Messures the lenght of time btw two intervals.
Can be messured in days, hours, muinutes, second, miliseconds...
Example:
```
SigninLogs
| project TimeGenerated, CreatedDateTime
| extend Difference = TimeGenerated - CreatedDateTime
| getschema
```
We can see that the difference column got a "timespan" datatype.
***
### Null
Sometimes a field is blank, if its a string datatype, than its just empty, if it anything else its 'Null'
```
SiginLogs
| where TimeGenerated ≥ ago(3d)
| where isnull(MfaDetail)
| project-reorder Timegenerated, MfaDetails
```
```
SigninLogs
| where TimeGenerated >= ago(3d)
| extend IsEmpty = isempty(ResultDescription)
| project TimeGenerated, IsEmpty, ResultDescription
| take 100
```
***
### Casting
A term used when changing a datatype from one to another
Below we have 2 integers, we will chnage them to string datatypes.
```
VMComputer
| project Field1=Cpus, Field2=CpuSpeed
| extend AdditionOffFields1and2 = Field1 + Field2
```
```
VMComputer
| project tostring (Field1=Cpus), (Field2=CpuSpeed)
| extend AdditionOffFields1and2 = Field1 + Field2
```
Since we changed datatypes now we can not perform math operations on the strings.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://digitalgarden.batamladen.com/notes/query-languages/kql/data-types.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.