arg_min

The arg_min aggregation in APL allows you to identify the row in a dataset where an expression evaluates to the minimum value. You can use this to retrieve other associated fields in the same row, making it particularly useful for pinpointing details about the smallest value in large datasets. If you group your data, arg_min finds the row within each group where a particular expression evaluates to the minimum value.

This aggregation is particularly useful in scenarios like the following:

• Pinpoint the shortest HTTP requests in log data and retrieve associated details (like URL, status code, and user agent) for the same row.
• Identify the fastest span durations in OpenTelemetry traces with additional context (like span name, trace ID, and attributes) for the same row.
• Highlight the lowest severity security alerts in logs along with relevant metadata (such as alert type, source, and timestamp) for the same row.

​

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

​

Usage

​

Syntax

| summarize arg_min(expression, field1, ..., fieldN)

​

Parameters

• expression: The expression to evaluate for the minimum value.
• field1, ..., fieldN: Additional fields to return from the row with the minimum value.

​

Returns

Returns a row where the expression evaluates to the minimum value for each group (or the entire dataset if no grouping is specified), containing the fields specified in the query.

​

Use case examples

• Log analysis
• OpenTelemetry traces
• Security logs

['sample-http-logs']
| summarize arg_min(req_duration_ms, uri) by method

​

List of related aggregations

• arg_max: Returns the row with the maximum value for a numeric field, useful for finding peak metrics.
• min: Returns only the minimum value of a numeric field without additional fields.
• percentile: Provides the value at a specific percentile of a numeric field.