> ## Documentation Index
> Fetch the complete documentation index at: https://axiom.co/docs/llms.txt
> Use this file to discover all available pages before exploring further.

<AgentInstructions>

## Submitting Feedback

If you encounter incorrect, outdated, or confusing documentation on this page, submit feedback:

POST https://axiom.co/docs/feedback

```json
{
  "path": "/apl/aggregation-function/arg-min",
  "feedback": "Description of the issue"
}
```

Only submit feedback when you have something specific and actionable to report.

</AgentInstructions>

# arg_min

> This page explains how to use the arg_min aggregation in APL.

The `arg_min` aggregation in APL allows you to identify the row in a dataset where an expression evaluates to the minimum value. You can use this to retrieve other associated fields in the same row, making it particularly useful for pinpointing details about the smallest value in large datasets. If you group your data, `arg_min` finds the row within each group where a particular expression evaluates to the minimum value.

This aggregation is particularly useful in scenarios like the following:

* Pinpoint the shortest HTTP requests in log data and retrieve associated details (like URL, status code, and user agent) for the same row.
* Identify the fastest span durations in OpenTelemetry traces with additional context (like span name, trace ID, and attributes) for the same row.
* Highlight the lowest severity security alerts in logs along with relevant metadata (such as alert type, source, and timestamp) for the same row.

## For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

<AccordionGroup>
  <Accordion title="Splunk SPL users">
    Splunk SPL doesn’t have an equivalent to `arg_min`. You can use `stats` with a combination of `values` and `first` clauses to evaluate the minimum value of a single numberic field. APL provides a dedicated `arg_min` aggregation that evaluates expressions.

    <CodeGroup>
      ```sql Splunk example theme={null}
      | stats min(req_duration_ms) as minDuration by id
      | where req_duration_ms=minDuration
      ```

      ```kusto APL equivalent theme={null}
      ['sample-http-logs']
      | summarize arg_min(req_duration_ms, id, uri)
      ```
    </CodeGroup>
  </Accordion>

  <Accordion title="ANSI SQL users">
    In ANSI SQL, achieving similar functionality often requires a combination of `MIN`, `GROUP BY`, and `JOIN` to retrieve the associated fields. APL's `arg_min` eliminates the need for multiple steps by directly returning the row with the minimum value.

    <CodeGroup>
      ```sql SQL example theme={null}
      SELECT id, uri
      FROM sample_http_logs
      WHERE req_duration_ms = (
          SELECT MIN(req_duration_ms)
          FROM sample_http_logs
      );
      ```

      ```kusto APL equivalent theme={null}
      ['sample-http-logs']
      | summarize arg_min(req_duration_ms, id, uri)
      ```
    </CodeGroup>
  </Accordion>
</AccordionGroup>

## Usage

### Syntax

```kusto theme={null}
| summarize arg_min(expression, field1, ..., fieldN)
```

### Parameters

* `expression`: The expression to evaluate for the minimum value.
* `field1, ..., fieldN`: Additional fields to return from the row with the minimum value. Use `*` as a wildcard to return all fields from the row.

<Note>
  The wildcard `*` is useful to return all fields from the row with the minimum value, but it increases query complexity and decreases performance.
</Note>

### Returns

Returns a row where the expression evaluates to the minimum value for each group (or the entire dataset if no grouping is specified), containing the fields specified in the query.

### Name fields

You can name fields in the parameters of `arg_min` using the syntax `arg_min(name1=expression, name2=field1)`. This specifies the field names that appear in the output.

**Query**

```kusto theme={null}
['otel-demo-traces']
| summarize arg_min(duration, longestSpan=span_id), arg_min(numEvents=array_length(events), spanWithMostEvents=span_id)
```

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'otel-demo-traces'%5D%20%7C%20summarize%20arg_min\(duration%2C%20longestSpan%3Dspan_id\)%2C%20arg_min\(numEvents%3Darray_length\(events\)%2C%20spanWithMostEvents%3Dspan_id\)%22%7D)

**Output**

| duration | longestSpan      | numEvents | spanWithMostEvents |
| -------- | ---------------- | --------- | ------------------ |
| 190ns    | 1a9f979bb25f6bbd | 1         | db13ffc3394905b5   |

## Use case examples

<Tabs>
  <Tab title="Log analysis">
    You can use `arg_min` to identify the path with the shortest duration and its associated details for each method.

    **Query**

    ```kusto theme={null}
    ['sample-http-logs']
    | summarize arg_min(req_duration_ms, uri) by method
    ```

    [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20summarize%20arg_min\(req_duration_ms%2C%20uri\)%20by%20method%22%7D)

    **Output**

    | req\_duration\_ms | uri        | method |
    | ----------------- | ---------- | ------ |
    | 0.1               | /api/login | POST   |

    This query identifies the paths with the shortest duration for each method and provides details about the path.
  </Tab>

  <Tab title="OpenTelemetry traces">
    Use `arg_min` to find the span with the shortest duration for each service and retrieve its associated details.

    **Query**

    ```kusto theme={null}
    ['otel-demo-traces']
    | summarize arg_min(duration, trace_id, span_id, kind) by ['service.name']
    ```

    [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'otel-demo-traces'%5D%20%7C%20summarize%20arg_min\(duration%2C%20trace_id%2C%20span_id%2C%20kind\)%20by%20%5B'service.name'%5D%22%7D)

    **Output**

    | duration | trace\_id | span\_id | service.name | kind   |
    | -------- | --------- | -------- | ------------ | ------ |
    | 00:00:01 | abc123    | span456  | frontend     | server |

    This query identifies the span with the shortest duration for each service along with its metadata.
  </Tab>

  <Tab title="Security logs">
    Find the lowest status code for each country in the `['sample-http-logs']` dataset.

    **Query**

    ```kusto theme={null}
    ['sample-http-logs']
    | summarize arg_min(toint(status), uri) by ['geo.country']
    ```

    [Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20summarize%20arg_min\(toint\(status\)%2C%20uri\)%20by%20%5B'geo.country'%5D%22%7D)

    **Output**

    | geo.country | uri        | status |
    | ----------- | ---------- | ------ |
    | USA         | /admin     | 200    |
    | Canada      | /dashboard | 201    |

    This query identifies the URI with the lowest status code for each country.
  </Tab>
</Tabs>

## List of related aggregations

* [arg\_max](/apl/aggregation-function/arg-max): Returns the row with the maximum value for a numeric field, useful for finding peak metrics.
* [min](/apl/aggregation-function/min): Returns only the minimum value of a numeric field without additional fields.
* [percentile](/apl/aggregation-function/percentile): Provides the value at a specific percentile of a numeric field.