max

The max aggregation in APL allows you to find the highest value in a specific column of your dataset. This is useful when you need to identify the maximum value of numerical data, such as the longest request duration, highest sales figures, or the latest timestamp in logs. The max function is ideal when you are working with large datasets and need to quickly retrieve the largest value, ensuring you’re focusing on the most critical or recent data point.

​

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

​

Usage

​

Syntax

summarize max(ColumnName)

​

Parameters

• ColumnName: The column or field from which you want to retrieve the maximum value. The column should contain numerical data, timespans, or dates.

​

Returns

The maximum value from the specified column.

​

Use case examples

• Log analysis
• OpenTelemetry traces
• Security logs

['sample-http-logs']
| summarize max(req_duration_ms)

​

List of related aggregations

• min: Retrieves the minimum value from a column, which is useful when you need to find the smallest or earliest value, such as the lowest request duration or first event in a log.
• avg: Calculates the average value of a column. This function helps when you want to understand the central tendency, such as the average response time for requests.
• sum: Sums all values in a column, making it useful when calculating totals, such as total sales or total number of requests over a period.
• count: Counts the number of records or non-null values in a column. It’s useful for finding the total number of log entries or transactions.
• percentile: Finds a value below which a specified percentage of data falls. This aggregation is helpful when you need to analyze performance metrics like latency at the 95th percentile.