diff --git a/data-explorer/kusto/query/arg-max-aggregation-function.md b/data-explorer/kusto/query/arg-max-aggregation-function.md index e7f6ba06dc..498d1151e7 100644 --- a/data-explorer/kusto/query/arg-max-aggregation-function.md +++ b/data-explorer/kusto/query/arg-max-aggregation-function.md @@ -1,15 +1,15 @@ --- title: arg_max() (aggregation function) -description: Learn how to use the arg_max() aggregation function to find a row in a group that maximizes the input expression. +description: Learn how to use the arg_max() aggregation function to find a row in a table that maximizes the input expression. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 11/11/2024 --- # arg_max() (aggregation function) > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds a row in the group that maximizes *ExprToMaximize*. +Finds a row in the table that maximizes the specified expression. It returns all columns of the input table or specified columns. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -25,12 +25,15 @@ Finds a row in the group that maximizes *ExprToMaximize*. | Name | Type | Required | Description | |--|--|--|--| -| *ExprToMaximize* | `string` | :heavy_check_mark: | The expression used for aggregation calculation. | -| *ExprToReturn* | `string` | :heavy_check_mark: | The expression used for returning the value when *ExprToMaximize* is maximum. Use a wildcard `*` to return all columns of the input table. | +| *ExprToMaximize* | `string` | :heavy_check_mark: | The expression for which the maximum value is determined. | +| *ExprToReturn* | `string` | :heavy_check_mark: | The expression determines which columns' values are returned, from the row that has the maximum value for *ExprToMaximize*. Use a wildcard `*` to return all columns. | ## Returns -Returns a row in the group that maximizes *ExprToMaximize*, and the values of columns specified in *ExprToReturn*. +Returns a row in the table that maximizes the specified expression *ExprToMaximize*, and the values of columns specified in *ExprToReturn*. + +> [!TIP] +> To see the maximal value only, use the [max() function](max-aggregation-function.md). ## Examples @@ -62,7 +65,9 @@ The results table displays only the first 10 rows. | TEXAS | 36.4607 | DARROUZETT | | ... | ... | ... | -Find the last time an event with a direct death happened in each state showing all the columns. +Find the last time an event with a direct death happened in each state, showing all the columns. + +The query first filters the events to only include those where there was at least one direct death. Then the query returns the entire row with the most recent StartTime. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -118,8 +123,61 @@ datatable(Fruit: string, Color: string, Version: int) [ | Banana | | Yellow | | Pear | 2 | Green | +## Comparison to max() + +The arg_max() function differs from the [max() function](max-aggregation-function.md). The arg_max() function allows you to return additional columns along with the maximum value, and [max()](max-aggregation-function.md) only returns the maximum value itself. + +### Examples + +#### arg_max() + +Find the last time an event with a direct death happened, showing all the columns in the table. + +The query first filters the events to only include those where there was at least one direct death. Then the query returns the entire row with the most recent (maximum) StartTime. + +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + +```kusto +StormEvents +| where DeathsDirect > 0 +| summarize arg_max(StartTime, *) +``` + +The results table returns all the columns for the row containing the highest value in the expression specified. + +| StartTime | EndTime | EpisodeId | EventId | State | EventType | ... | +|--|--|--|--| +| 2007-12-31T15:00:00Z | 2007-12-31T15:00:00 | 12688 | 69700 | UTAH | Avalanche | ... | + +#### max() + +Find the last time an event with a direct death happened. + +The query filters events to only include those where there is at least one direct death, and then returns the maximum value for StartTime. + +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + +```kusto +StormEvents +| where DeathsDirect > 0 +| summarize max(StartTime) +``` + +The results table returns the maximum value of StartTime, without returning other columns for this record. + +| max_StartTime | +| --- | +| 2007-12-31T15:00:00Z | + ## Related content -* [arg_min function](arg-min-aggregation-function.md) -* [take_any function](take-any-aggregation-function.md) -* [take_anyif function](take-anyif-aggregation-function.md) +* [max function](max-aggregation-function.md) +* [min function](min-aggregation-function.md) +* [avg function](avg-aggregation-function.md) +* [percentile function](percentiles-aggregation-function.md) diff --git a/data-explorer/kusto/query/arg-min-aggregation-function.md b/data-explorer/kusto/query/arg-min-aggregation-function.md index 380858e61f..bfb9501015 100644 --- a/data-explorer/kusto/query/arg-min-aggregation-function.md +++ b/data-explorer/kusto/query/arg-min-aggregation-function.md @@ -1,6 +1,6 @@ --- title: arg_min() (aggregation function) -description: Learn how to use the arg_min() aggregation function to find a row in a group that minimizes the input expression. +description: Learn how to use the arg_min() aggregation function to find a row in a table that minimizes the input expression. ms.reviewer: alexans ms.topic: reference ms.date: 08/11/2024 @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds a row in the group that minimizes *ExprToMinimize*. +Finds a row in the table that minimizes the specified expression. It returns all columns of the input table or specified columns. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -25,16 +25,19 @@ Finds a row in the group that minimizes *ExprToMinimize*. | Name | Type | Required | Description | |--|--|--|--| -| *ExprToMinimize*| `string` | :heavy_check_mark: | The expression used for aggregation calculation. | -| *ExprToReturn* | `string` | :heavy_check_mark: | The expression used for returning the value when *ExprToMinimize* is minimum. Use a wildcard (*) to return all columns of the input table. | +| *ExprToMinimize*| `string` | :heavy_check_mark: | The expression for which the minimum value is determined. | +| *ExprToReturn* | `string` | :heavy_check_mark: | The expression determines which columns' values are returned, from the row that has the minimum value for *ExprToMinimize*. Use a wildcard `*` to return all columns. | ## Null handling -When *ExprToMinimize* is null for all rows in a group, one row in the group is picked. Otherwise, rows where *ExprToMinimize* is null are ignored. +When *ExprToMinimize* is null for all rows in a table, one row in the table is picked. Otherwise, rows where *ExprToMinimize* is null are ignored. ## Returns -Returns a row in the group that minimizes *ExprToMinimize*, and the value of *ExprToReturn*. Use or `*` to return the entire row. +Returns a row in the table that minimizes *ExprToMinimize*, and the values of columns specified in *ExprToReturn*. Use or `*` to return the entire row. + +> [!TIP] +> To see the minimal value only, use the [min() function](min-aggregation-function.md). ## Examples @@ -66,7 +69,9 @@ The results table shown includes only the first 10 rows. | OHIO | 38.42 | SOUTH PT | | ... | ... | ... | -Find the first time an event with a direct death happened in each state showing all of the columns. +Find the first time an event with a direct death happened in each state, showing all of the columns. + +The query first filters the events to only include those where there was at least one direct death. Then the query returns the entire row with the lowest value for StartTime. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -122,8 +127,62 @@ datatable(Fruit: string, Color: string, Version: int) [ | Banana | | Yellow | | Pear | 1 | Brown | +## Comparison to min() + +The arg_min() function differs from the [min() function](min-aggregation-function.md). The arg_min() function allows you to return additional columns along with the minimum value, and [min()](min-aggregation-function.md) only returns the minimum value itself. + +### Examples + +#### arg_min() + +Find the first time an event with a direct death happened, showing all the columns in the table. + +The query first filters the events to only include those where there was at least one direct death. Then the query returns the entire row with the lowest value for StartTime. + +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + +```kusto +StormEvents +| where DeathsDirect > 0 +| summarize arg_min(StartTime, *) +``` + +The results table returns all the columns for the row containing the lowest value in the expression specified. + +| StartTime | EndTime | EpisodeId | EventId | State | EventType | ... | +|--|--|--|--| +| 2007-01-01T00:00:00Z | 2007-01-22T18:49:00Z | 2408 | 11929 | INDIANA | Flood | ... | + +#### min() + +Find the first time an event with a direct death happened. + +The query filters events to only include those where there is at least one direct death, and then returns the minimum value for StartTime. + +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + +```kusto +StormEvents +| where DeathsDirect > 0 +| summarize min(StartTime) +``` + +The results table returns the lowest value in the specific column only. + +| min_StartTime | +| --- | +| 2007-01-01T00:00:00Z | + ## Related content -* [arg_max function](arg-max-aggregation-function.md) -* [take_any function](take-any-aggregation-function.md) -* [take_anyif function](take-anyif-aggregation-function.md) \ No newline at end of file +* [min function](min-aggregation-function.md) +* [max function](max-aggregation-function.md) +* [avg function](avg-aggregation-function.md) +* [percentile function](percentiles-aggregation-function.md) +* [min-of function](min-of-function.md) diff --git a/data-explorer/kusto/query/iff-function.md b/data-explorer/kusto/query/iff-function.md index ae98844b26..a3468c1c0f 100644 --- a/data-explorer/kusto/query/iff-function.md +++ b/data-explorer/kusto/query/iff-function.md @@ -3,7 +3,7 @@ title: iff() description: This article describes iff(). ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 11/27/2024 --- # iff() @@ -31,7 +31,11 @@ Returns the *:::no-loc text="then":::* value when the *:::no-loc text="if":::* c This function returns the *:::no-loc text="then":::* value when the *:::no-loc text="if":::* condition evaluates to `true`, otherwise it returns the *:::no-loc text="else":::* value. -## Example +## Examples + +### Classify data using iff() + +The following query uses the `iff()` function to categorize storm events as either "Rain event" or "Not rain event" based on their event type, and then projects the state, event ID, event type, and the new rain category. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -56,3 +60,34 @@ The following table shows only the first five rows. |GEORGIA| 64588 |Thunderstorm Wind |Not rain event| |MISSISSIPPI| 68796 |Thunderstorm Wind |Not rain event| |...|...|...|...| + +### Combine iff() with other functions + +The following query calculates the total damage from crops and property, categorizes the severity of storm events based on total damage, direct injuries, and direct deaths, and then summarizes the total number of events and the number of events by severity. + +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + +```kusto +StormEvents +| extend TotalDamage = DamageCrops + DamageProperty +| extend Severity = iff(TotalDamage > 1000000 or InjuriesDirect > 10 or DeathsDirect > 0, "High", iff(TotalDamage < 50000 and InjuriesDirect == 0 and DeathsDirect == 0, "Low", "Moderate")) +| summarize TotalEvents = count(), SeverityEvents = count() by Severity +``` + +**Output** + +| Severity | TotalEvents | +|----------|-------------| +| Low | 54805 | +| High | 977 | +| Moderate | 3284 | + +## Related content + +* [Scalar function types summary](scalar-functions.md) +* [array_iff()](array-iff-function.md) +* [bin()](bin-function.md) +* [extend operator](extend-operator.md) diff --git a/data-explorer/kusto/query/max-aggregation-function.md b/data-explorer/kusto/query/max-aggregation-function.md index 317268abbd..4df6fe5326 100644 --- a/data-explorer/kusto/query/max-aggregation-function.md +++ b/data-explorer/kusto/query/max-aggregation-function.md @@ -1,15 +1,15 @@ --- title: max() (aggregation function) -description: Learn how to use the max() function to find the maximum value of the expression in the group. +description: Learn how to use the max() function to find the maximum value of the expression in the table. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 11/11/2024 --- # max() (aggregation function) > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds the maximum value the expression in the group. +Finds the maximum value of the expression in the table. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -23,18 +23,18 @@ Finds the maximum value the expression in the group. | Name | Type | Required | Description | |--|--|--|--| -| *expr* | `string` | :heavy_check_mark: | The expression used for the aggregation calculation. | +| *expr* | `string` | :heavy_check_mark: | The expression for which the maximum value is determined. | ## Returns -Returns the maximum value of *expr* across the group. +Returns the value in the table that maximizes the specified expression. > [!TIP] > This gives you the max on its own. If you want to see other columns in addition to the max, use [arg_max](arg-max-aggregation-function.md). ## Example -This example returns the last record in a table. +This example returns the last record in a table by querying the maximum value for StartTime. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -54,6 +54,7 @@ StormEvents ## Related content +* [arg_max](arg-max-aggregation-function.md) * [min function](min-aggregation-function.md) * [avg function](avg-aggregation-function.md) -* [percentile function](percentiles-aggregation-function.md) \ No newline at end of file +* [percentile function](percentiles-aggregation-function.md) diff --git a/data-explorer/kusto/query/min-aggregation-function.md b/data-explorer/kusto/query/min-aggregation-function.md index be49da36f3..255a07d712 100644 --- a/data-explorer/kusto/query/min-aggregation-function.md +++ b/data-explorer/kusto/query/min-aggregation-function.md @@ -1,15 +1,15 @@ --- title: min() (aggregation function) -description: Learn how to use the min() function to find the minimum value in a group. +description: Learn how to use the min() function to find the minimum value in a table. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 11/12/2024 --- # min() (aggregation function) > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds the minimum value across the group. +Finds the minimum value of the expression in the table. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -23,11 +23,11 @@ Finds the minimum value across the group. | Name | Type | Required | Description | |--|--|--|--| -| *expr* | `string` | :heavy_check_mark: | The expression used for the minimum value aggregation calculation. | +| *expr* | `string` | :heavy_check_mark: | The expression for which the minimum value is determined. | ## Returns -Returns the minimum value of *expr* across the group. +Returns the minimum value of *expr* across the table. > [!TIP] > This gives you the min on its own. If you want to see other columns in addition to the min, use [arg_min](arg-min-aggregation-function.md). @@ -54,6 +54,7 @@ StormEvents ## Related content +* [arg_min function](arg-min-aggregation-function.md) * [max function](max-aggregation-function.md) * [avg function](avg-aggregation-function.md) * [percentile function](percentiles-aggregation-function.md)