How to use variables with let in KQL: step by step

In KQL, the let operator lets you give a name to a value or to the result of a query and reuse it as many times as you need. Working with variables with let in KQL makes queries more readable, avoids repeating the same numbers and filters, and makes maintenance easier when a threshold or a time range changes. It is one of the first techniques worth mastering once you start writing larger queries, and you will find it at the start of almost every well-written KQL query.

Prerequisites

• Access to an environment that runs KQL: Azure Data Explorer, a KQL Queryset in Microsoft Fabric (Real-Time Analytics), or Azure Monitor / Log Analytics.
• A table with some data. The examples use a sample table called Sales, with the columns Amount, Region and Timestamp.
• Basic KQL knowledge, such as the where and summarize operators.

Step 1: Create your first variable with let

A statement starts with the word let, followed by the name, an equals sign and the value. Each let statement ends with a semicolon, and the query that uses it comes next. In the example, we store a threshold in a variable and use it in the filter. The name can contain letters, numbers and underscores, and it is case-sensitive.

let amountThreshold = 1000;
Sales
| where Amount > amountThreshold

If tomorrow you want to analyse sales above 5000, you change only the number on the first line, instead of hunting for it in the middle of the query.

Step 2: Store text, dates and time ranges

The let operator is not just for numbers. You can also store text, dates and time intervals. This is handy to define an analysis period once and reuse it across several filters.

let region = "North";
let startDate = ago(30d);
Sales
| where Region == region
| where Timestamp >= startDate

The ago(30d) function returns the moment 30 days ago. By storing it in a variable, you make sure every filter starts from exactly the same point in time.

Step 3: Store the result of a query

A variable with let in KQL can also hold an entire table, that is, the result of another query. You then use that name as if it were a normal table. This lets you split a complex query into parts that are easier to read, and you can chain several tabular variables, each one preparing a piece of the data.

let RecentSales =
    Sales
    | where Timestamp >= ago(7d);
RecentSales
| summarize TotalByRegion = sum(Amount) by Region
| order by TotalByRegion desc

First we define RecentSales with the last 7 days of data. Then we aggregate that result by region. Notice that the statement ends with a semicolon, but the final query does not.

Step 4: Reuse values and create small functions

The biggest benefit appears when the same value is used more than once. With let, you define it once and reference the name wherever you need it. You can even create small functions for repeated calculations.

let vatRate = 1.23;
let addVat = (value:real) { value * vatRate };
Sales
| extend AmountWithVat = addVat(Amount)
| project Region, Amount, AmountWithVat

Here addVat is a function created with let that takes a value and returns it with VAT included. If the rate changes, you update only the vatRate variable and the whole calculation follows.

Tip: give your variables descriptive names, like amountThreshold instead of x. KQL queries read from top to bottom, and good names save you comments.

Check the result

Run each query and confirm it returns rows without errors. To test that the variables work, change the value in a let statement (for example, amountThreshold from 1000 to 5000) and run it again: the number of rows should change according to the new filter. If you get a syntax error, check that each let statement ends with a semicolon and that the final query does not have an extra one. It is worth saving the queries that work so you can reuse them later.

Conclusion

With let you can already name values, store time ranges and query results, and create small functions to avoid repeating logic. The next step is to combine tabular variables with join or union for richer analysis, keeping each part readable. Which value do you repeat the most in your queries that you could turn into a let variable right now?