ecstrim
ecstrim

Reputation: 61

Kusto - Last row by timestamp for every series

I have a table where messages are logged, for every operation there are several messages with timestamp. I need to get the last message for every operation_id.

Example data:

timestamp                  | operation_id | message 
---------------------------|--------------------------------------------------------
10/2/2019, 10:00:10.000 AM |    1         | message (last msg for this operation id)
10/2/2019, 10:00:00.000 AM |    1         | message
10/2/2019, 10:00:03.000 AM |    2         | message (last msg for this operation id)
10/2/2019, 10:00:00.000 AM |    3         | message
10/2/2019, 10:00:00.000 AM |    2         | message
10/2/2019, 10:00:15.000 AM |    3         | message (last msg for this operation id)

Desired output:

timestamp                  | operation_id | message 
---------------------------|--------------------------------------------------------
10/2/2019, 10:00:10.000 AM |    1         | message (last msg for this operation id)
10/2/2019, 10:00:03.000 AM |    2         | message (last msg for this operation id)
10/2/2019, 10:00:15.000 AM |    3         | message (last msg for this operation id)

Upvotes: 2

Views: 4487

Answers (1)

Avnera
Avnera

Reputation: 7618

Take a look at the aggregation function arg_max()

Note that the applicable examples are in the arg_min() doc...

Upvotes: 5

Related Questions