CODEWITHSUNDEEP
azure-data-explorerkql
Anagh Goswami
Anagh Goswami

Reputation: 68

Kusto select distinct on one column only

Example Query -

traces | project message, timestamp

This outputs something like this -

message  |   timestamp
------------------------------
    A      2022-07-09 00:00:00
    B      2022-07-11 01:00:00
    A      2022-07-11 02:00:00

I want a query that gives this as output -

message  |   timestamp
------------------------------
    A      2022-07-09 00:00:00
    B      2022-07-11 01:00:00

Upvotes: 1

Views: 2268

Answers (1)

Yoni L.
Yoni L.

Reputation: 25895

you could use the min() aggregation function if you only have 2 fields of interest (message, timestamp), or the arg_min() aggregation function otherwise.

e.g.

traces | summarize min(timestamp) by message

traces | summarize arg_min(timestamp, *) by message

Upvotes: 1

Related Questions