CODEWITHSUNDEEP
azure-data-explorer
Anders Sewerin Johansen
Anders Sewerin Johansen

Reputation: 1666

Find max count for a combination of several fields

Say I have a table with three fields message, environment and function.

I want to count up the records by message, environment and function, and then select the highest scoring row for any combination.

Getting the counts is easy

Table
| summarize count() by message, environment, function

...but how do I get just one row with the top count? My solution so far is to create a new table that tallies the counts, then tally max() by environment, function and then do a join, but this seems like an expensive and complicated workaround.

Upvotes: 0

Views: 2962

Answers (2)

Yoni L.
Yoni L.

Reputation: 25955

If I understand your original question correctly, you may want to look into summarize arg_max() as well: https://learn.microsoft.com/en-us/azure/kusto/query/arg-max-aggfunction

Upvotes: 1

Anders Sewerin Johansen
Anders Sewerin Johansen

Reputation: 1666

Ah, just modify the solution here to use max instead of sum

Add column of totals pr. field value

Upvotes: 0

Related Questions