summarize operator

Produces a table that aggregates the content of the dataset.

Syntax

| summarize [[Column =] Aggregation [, ...]] [by [Column =] GroupExpression [, ...]]

Arguments

nametypedescription
FieldstringResult Field Name
AggregationfunctionA call to an aggregation function such as min() or max(), with Field names as arguments.
GroupExpressionexpressionA scalar expression that can reference the dataset

Returns

  • The input rows are arranged into groups having the same values of the by expressions.
  • Then the specified aggregation functions are computed over each group, producing a row for each group.
  • The result contains the by columns and also at least one column for each computed aggregate. (Some aggregation functions return multiple columns.)

Examples

['http-logs']
| summarize topk(content_type, 20)
['githubreleaseevent']
| summarize topk(repo, 20) by bin(_time, 24h)

Returns a table that shows the heatmap in each interval [0, 30], [30, 20, 10], and so on. This example has a cell for HISTOGRAM(req_duration_ms).

['http-logs']
| summarize histogram(req_duration_ms, 30)
['githubpushevent']
| where _time > ago(7d)
| where repo contains "axiom"
| summarize count(), numCommits=sum(size) by _time=bin(_time, 3h), repo
| take 100

Was this page helpful?