From 72ec0e7dc2013249f3ea61bee64106b08a7e8d98 Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Wed, 6 Nov 2024 15:10:12 +0200 Subject: [PATCH 01/19] Added in tip --- data-explorer/kusto/query/arg-max-aggregation-function.md | 7 ++++++- data-explorer/kusto/query/max-aggregation-function.md | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/data-explorer/kusto/query/arg-max-aggregation-function.md b/data-explorer/kusto/query/arg-max-aggregation-function.md index 3e78bb3224..883f5a7a2a 100644 --- a/data-explorer/kusto/query/arg-max-aggregation-function.md +++ b/data-explorer/kusto/query/arg-max-aggregation-function.md @@ -3,13 +3,15 @@ title: arg_max() (aggregation function) description: Learn how to use the arg_max() aggregation function to find a row in a group that maximizes the input expression. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 11/11/2024 --- # arg_max() (aggregation function) > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] Finds a row in the group that maximizes *ExprToMaximize*. +The arg_max() function is used in conjunction with the summarize operator and finds a row in the group that maximizes the expression specified. It can return all columns of the input table or specific columns +The arg_max() function is used to find a row in a group that maximizes a specified expression. It returns the values of columns specified in the expression [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -32,6 +34,9 @@ Finds a row in the group that maximizes *ExprToMaximize*. Returns a row in the group that maximizes *ExprToMaximize*, and the values of columns specified in *ExprToReturn*. +> [!TIP] +> To see the maximal value only, use the [max aggregation function](max-aggregation-function.md). + ## Examples Find the maximum latitude of a storm event in each state. diff --git a/data-explorer/kusto/query/max-aggregation-function.md b/data-explorer/kusto/query/max-aggregation-function.md index 317268abbd..bedfe20f55 100644 --- a/data-explorer/kusto/query/max-aggregation-function.md +++ b/data-explorer/kusto/query/max-aggregation-function.md @@ -3,7 +3,7 @@ title: max() (aggregation function) description: Learn how to use the max() function to find the maximum value of the expression in the group. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 11/11/2024 --- # max() (aggregation function) From 877b1e9f79d22432d13e28492f30c0165b7c338f Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Mon, 11 Nov 2024 14:17:35 +0200 Subject: [PATCH 02/19] added examples showing difference between max() and arg_max() --- .../query/arg-max-aggregation-function.md | 47 ++++++++++++++++--- 1 file changed, 41 insertions(+), 6 deletions(-) diff --git a/data-explorer/kusto/query/arg-max-aggregation-function.md b/data-explorer/kusto/query/arg-max-aggregation-function.md index 883f5a7a2a..a9383d9197 100644 --- a/data-explorer/kusto/query/arg-max-aggregation-function.md +++ b/data-explorer/kusto/query/arg-max-aggregation-function.md @@ -9,9 +9,7 @@ ms.date: 11/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds a row in the group that maximizes *ExprToMaximize*. -The arg_max() function is used in conjunction with the summarize operator and finds a row in the group that maximizes the expression specified. It can return all columns of the input table or specific columns -The arg_max() function is used to find a row in a group that maximizes a specified expression. It returns the values of columns specified in the expression +Finds a row in the group that maximizes the specified expression. It returns all columns of the input table or specific columns. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -27,12 +25,12 @@ The arg_max() function is used to find a row in a group that maximizes a specifi | Name | Type | Required | Description | |--|--|--|--| -| *ExprToMaximize* | `string` | :heavy_check_mark: | The expression used for aggregation calculation. | -| *ExprToReturn* | `string` | :heavy_check_mark: | The expression used for returning the value when *ExprToMaximize* is maximum. Use a wildcard `*` to return all columns of the input table. | +| *ExprToMaximize* | `string` | :heavy_check_mark: | The expression specifies the expression or column that you want to maximize. | +| *ExprToReturn* | `string` | :heavy_check_mark: | The expression determines which columns' values are returned from the row that has the maximum value for *ExprToMaximize*. Use a wildcard `*` to return all columns. | ## Returns -Returns a row in the group that maximizes *ExprToMaximize*, and the values of columns specified in *ExprToReturn*. +Returns a row in the group that maximizes the specified expression *ExprToMaximize*, and the values of columns specified in *ExprToReturn*. > [!TIP] > To see the maximal value only, use the [max aggregation function](max-aggregation-function.md). @@ -122,3 +120,40 @@ datatable(Fruit: string, Color: string, Version: int) [ | Apple | 1 | Red | | Banana | | Yellow | | Pear | 2 | Green | + +## Comparison to max() + +The arg_max() function differs from the max() function. The arg_max() function allows you to return additional columns along with the maximum value, and max() only returns the maximum value itself. + +## Examples + +### arg_max() +Find the last time an event with a direct death happened showing all the columns in the table. + +```kusto +StormEvents +| where DeathsDirect > 0 +| summarize arg_max(StartTime, *) +``` + +The results table returns all the columns for the row containing the highest value in the expression specified. + +| StartTime | EndTime | EpisodeId | EventId | State | EventType | +|--|--|--| +| 2007-12-31T15:00:00Z | 2007-12-31T15:00:00 | 12688 | 69700 | UTAH | Avalanche | + +### max() + +Find the last time an event with a direct death happened. + +```kusto +StormEvents +| where DeathsDirect > 0 +| summarize max(StartTime) +``` + +The results table returns the highest value in a specific column and that value alone. + +| max_StartTime | +| --- | +| 2007-12-31T15:00:00Z | From 6566292fa7f481f513e83cd04de279f9b840f288 Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Mon, 11 Nov 2024 21:06:39 +0200 Subject: [PATCH 03/19] Added "run the query" links --- .../query/arg-max-aggregation-function.md | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/data-explorer/kusto/query/arg-max-aggregation-function.md b/data-explorer/kusto/query/arg-max-aggregation-function.md index a9383d9197..c117c3336e 100644 --- a/data-explorer/kusto/query/arg-max-aggregation-function.md +++ b/data-explorer/kusto/query/arg-max-aggregation-function.md @@ -33,7 +33,7 @@ Finds a row in the group that maximizes the specified expression. It returns all Returns a row in the group that maximizes the specified expression *ExprToMaximize*, and the values of columns specified in *ExprToReturn*. > [!TIP] -> To see the maximal value only, use the [max aggregation function](max-aggregation-function.md). +> To see the maximal value only, use the [max() function](max-aggregation-function.md). ## Examples @@ -123,13 +123,18 @@ datatable(Fruit: string, Color: string, Version: int) [ ## Comparison to max() -The arg_max() function differs from the max() function. The arg_max() function allows you to return additional columns along with the maximum value, and max() only returns the maximum value itself. +The arg_max() function differs from the [max() function](max-aggregation-function.md). The arg_max() function allows you to return additional columns along with the maximum value, and [max()](max-aggregation-function.md) only returns the maximum value itself. -## Examples +### Examples -### arg_max() +**arg_max()** Find the last time an event with a direct death happened showing all the columns in the table. +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + ```kusto StormEvents | where DeathsDirect > 0 @@ -142,10 +147,15 @@ The results table returns all the columns for the row containing the highest val |--|--|--| | 2007-12-31T15:00:00Z | 2007-12-31T15:00:00 | 12688 | 69700 | UTAH | Avalanche | -### max() +**max()** Find the last time an event with a direct death happened. +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + ```kusto StormEvents | where DeathsDirect > 0 From 70339536afbe3b55272934d585f027477fef0f3f Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Mon, 11 Nov 2024 21:22:03 +0200 Subject: [PATCH 04/19] Bullet formatting --- data-explorer/kusto/query/arg-max-aggregation-function.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/data-explorer/kusto/query/arg-max-aggregation-function.md b/data-explorer/kusto/query/arg-max-aggregation-function.md index c117c3336e..0469e163e2 100644 --- a/data-explorer/kusto/query/arg-max-aggregation-function.md +++ b/data-explorer/kusto/query/arg-max-aggregation-function.md @@ -9,7 +9,7 @@ ms.date: 11/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds a row in the group that maximizes the specified expression. It returns all columns of the input table or specific columns. +Finds a row in the group that maximizes the specified expression. It returns all columns of the input table or specified columns. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -127,7 +127,8 @@ The arg_max() function differs from the [max() function](max-aggregation-functio ### Examples -**arg_max()** +#### arg_max() + Find the last time an event with a direct death happened showing all the columns in the table. :::moniker range="azure-data-explorer" @@ -147,7 +148,7 @@ The results table returns all the columns for the row containing the highest val |--|--|--| | 2007-12-31T15:00:00Z | 2007-12-31T15:00:00 | 12688 | 69700 | UTAH | Avalanche | -**max()** +#### max() Find the last time an event with a direct death happened. From d998f76ed7bca0b879fd9b266c4c80a80ebfbc89 Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Mon, 11 Nov 2024 21:26:47 +0200 Subject: [PATCH 05/19] Minor tweaks --- .../kusto/query/arg-max-aggregation-function.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/data-explorer/kusto/query/arg-max-aggregation-function.md b/data-explorer/kusto/query/arg-max-aggregation-function.md index 0469e163e2..25933f1a14 100644 --- a/data-explorer/kusto/query/arg-max-aggregation-function.md +++ b/data-explorer/kusto/query/arg-max-aggregation-function.md @@ -129,7 +129,7 @@ The arg_max() function differs from the [max() function](max-aggregation-functio #### arg_max() -Find the last time an event with a direct death happened showing all the columns in the table. +Find the last time an event with a direct death happened, showing all the columns in the table. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -144,9 +144,9 @@ StormEvents The results table returns all the columns for the row containing the highest value in the expression specified. -| StartTime | EndTime | EpisodeId | EventId | State | EventType | -|--|--|--| -| 2007-12-31T15:00:00Z | 2007-12-31T15:00:00 | 12688 | 69700 | UTAH | Avalanche | +| StartTime | EndTime | EpisodeId | EventId | State | EventType | ... | +|--|--|--|--| +| 2007-12-31T15:00:00Z | 2007-12-31T15:00:00 | 12688 | 69700 | UTAH | Avalanche | ... | #### max() @@ -163,7 +163,7 @@ StormEvents | summarize max(StartTime) ``` -The results table returns the highest value in a specific column and that value alone. +The results table returns the highest value in the specific column only. | max_StartTime | | --- | From fd93bbf3d30d5009e589347c80d0d078757184c9 Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Tue, 12 Nov 2024 09:56:44 +0200 Subject: [PATCH 06/19] Updates to arg-min() and min(), and added related content --- .../query/arg-max-aggregation-function.md | 11 ++- .../query/arg-min-aggregation-function.md | 69 +++++++++++++++++-- .../kusto/query/max-aggregation-function.md | 9 +-- .../kusto/query/min-aggregation-function.md | 5 +- 4 files changed, 81 insertions(+), 13 deletions(-) diff --git a/data-explorer/kusto/query/arg-max-aggregation-function.md b/data-explorer/kusto/query/arg-max-aggregation-function.md index 25933f1a14..1d71935960 100644 --- a/data-explorer/kusto/query/arg-max-aggregation-function.md +++ b/data-explorer/kusto/query/arg-max-aggregation-function.md @@ -25,7 +25,7 @@ Finds a row in the group that maximizes the specified expression. It returns all | Name | Type | Required | Description | |--|--|--|--| -| *ExprToMaximize* | `string` | :heavy_check_mark: | The expression specifies the expression or column that you want to maximize. | +| *ExprToMaximize* | `string` | :heavy_check_mark: | The expression specifies the column that you want to maximize. | | *ExprToReturn* | `string` | :heavy_check_mark: | The expression determines which columns' values are returned from the row that has the maximum value for *ExprToMaximize*. Use a wildcard `*` to return all columns. | ## Returns @@ -65,7 +65,7 @@ The results table displays only the first 10 rows. | TEXAS | 36.4607 | DARROUZETT | | ... | ... | ... | -Find the last time an event with a direct death happened in each state showing all the columns. +Find the last time an event with a direct death happened in each state, showing all the columns. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -168,3 +168,10 @@ The results table returns the highest value in the specific column only. | max_StartTime | | --- | | 2007-12-31T15:00:00Z | + +## Related content + +* [max fnction](max-aggregation-function.md) +* [min function](min-aggregation-function.md) +* [avg function](avg-aggregation-function.md) +* [percentile function](percentiles-aggregation-function.md) diff --git a/data-explorer/kusto/query/arg-min-aggregation-function.md b/data-explorer/kusto/query/arg-min-aggregation-function.md index d98e03eeb7..0b0c9ce739 100644 --- a/data-explorer/kusto/query/arg-min-aggregation-function.md +++ b/data-explorer/kusto/query/arg-min-aggregation-function.md @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds a row in the group that minimizes *ExprToMinimize*. +Finds a row in the group that minimizes the specified expression. It returns all columns of the input table or specified columns. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -25,8 +25,8 @@ Finds a row in the group that minimizes *ExprToMinimize*. | Name | Type | Required | Description | |--|--|--|--| -| *ExprToMinimize*| `string` | :heavy_check_mark: | The expression used for aggregation calculation. | -| *ExprToReturn* | `string` | :heavy_check_mark: | The expression used for returning the value when *ExprToMinimize* is minimum. Use a wildcard (*) to return all columns of the input table. | +| *ExprToMinimize*| `string` | :heavy_check_mark: | The expression specifies the expression or column that you want to minimize. | +| *ExprToReturn* | `string` | :heavy_check_mark: | The expression determines which columns' values are returned from the row that has the minimum value for *ExprToMinimize*. Use a wildcard `*` to return all columns. | ## Null handling @@ -34,7 +34,10 @@ When *ExprToMinimize* is null for all rows in a group, one row in the group is p ## Returns -Returns a row in the group that minimizes *ExprToMinimize*, and the value of *ExprToReturn*. Use or `*` to return the entire row. +Returns a row in the group that minimizes *ExprToMinimize*, and the values of columns specified in *ExprToReturn*. Use or `*` to return the entire row. + +> [!TIP] +> To see the minimal value only, use the [min() function](min-aggregation-function.md). ## Examples @@ -66,7 +69,7 @@ The results table shown includes only the first 10 rows. | OHIO | 38.42 | SOUTH PT | | ... | ... | ... | -Find the first time an event with a direct death happened in each state showing all of the columns. +Find the first time an event with a direct death happened in each state, showing all of the columns. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -121,3 +124,59 @@ datatable(Fruit: string, Color: string, Version: int) [ | Apple | 1 | Red | | Banana | | Yellow | | Pear | 1 | Brown | + +## Comparison to min() + +The arg_min() function differs from the [min() function](min-aggregation-function.md). The arg_min() function allows you to return additional columns along with the minimum value, and [min()](min-aggregation-function.md) only returns the minimum value itself. + +### Examples + +#### arg_min() + +Find the first time an event with a direct death happened, showing all the columns in the table. + +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + +```kusto +StormEvents +| where DeathsDirect > 0 +| summarize arg_min(StartTime, *) +``` + +The results table returns all the columns for the row containing the lowest value in the expression specified. + +| StartTime | EndTime | EpisodeId | EventId | State | EventType | ... | +|--|--|--|--| +| 2007-01-01T00:00:00Z | 2007-01-22T18:49:00Z | 2408 | 11929 | INDIANA | Flood | ... | + +#### min() + +Find the first time an event with a direct death happened. + +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + +```kusto +StormEvents +| where DeathsDirect > 0 +| summarize max(StartTime) +``` + +The results table returns the lowest value in the specific column only. + +| max_StartTime | +| --- | +| 2007-01-01T00:00:00Z | + +## Related content + +* [min function](min-aggregation-function.md) +* [max function](max-aggregation-function.md) +* [avg function](avg-aggregation-function.md) +* [percentile function](percentiles-aggregation-function.md) +* [min-of function](min-of-function.md) diff --git a/data-explorer/kusto/query/max-aggregation-function.md b/data-explorer/kusto/query/max-aggregation-function.md index bedfe20f55..6e16212e80 100644 --- a/data-explorer/kusto/query/max-aggregation-function.md +++ b/data-explorer/kusto/query/max-aggregation-function.md @@ -9,7 +9,7 @@ ms.date: 11/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds the maximum value the expression in the group. +Finds the maximum value of the expression in the group. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -23,11 +23,11 @@ Finds the maximum value the expression in the group. | Name | Type | Required | Description | |--|--|--|--| -| *expr* | `string` | :heavy_check_mark: | The expression used for the aggregation calculation. | +| *expr* | `string` | :heavy_check_mark: | The expression specifies the column that you want to maximize. | ## Returns -Returns the maximum value of *expr* across the group. +Returns the value in the group that maximizes the specified expression. > [!TIP] > This gives you the max on its own. If you want to see other columns in addition to the max, use [arg_max](arg-max-aggregation-function.md). @@ -54,6 +54,7 @@ StormEvents ## Related content +* [arg_max](arg-max-aggregation-function.md) * [min function](min-aggregation-function.md) * [avg function](avg-aggregation-function.md) -* [percentile function](percentiles-aggregation-function.md) \ No newline at end of file +* [percentile function](percentiles-aggregation-function.md) diff --git a/data-explorer/kusto/query/min-aggregation-function.md b/data-explorer/kusto/query/min-aggregation-function.md index be49da36f3..0232ddafa5 100644 --- a/data-explorer/kusto/query/min-aggregation-function.md +++ b/data-explorer/kusto/query/min-aggregation-function.md @@ -3,13 +3,13 @@ title: min() (aggregation function) description: Learn how to use the min() function to find the minimum value in a group. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 11/12/2024 --- # min() (aggregation function) > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds the minimum value across the group. +Finds the minimum value of the expression in the group. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -54,6 +54,7 @@ StormEvents ## Related content +* [arg_min function](arg-min-aggregation-function.md) * [max function](max-aggregation-function.md) * [avg function](avg-aggregation-function.md) * [percentile function](percentiles-aggregation-function.md) From 2100e0e2a8948c61cb15bab1a68ea149aeb93979 Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Tue, 12 Nov 2024 10:14:20 +0200 Subject: [PATCH 07/19] Tweaks after checking the preview docs --- data-explorer/kusto/query/arg-min-aggregation-function.md | 6 +++--- data-explorer/kusto/query/min-aggregation-function.md | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/data-explorer/kusto/query/arg-min-aggregation-function.md b/data-explorer/kusto/query/arg-min-aggregation-function.md index 0b0c9ce739..45db574db4 100644 --- a/data-explorer/kusto/query/arg-min-aggregation-function.md +++ b/data-explorer/kusto/query/arg-min-aggregation-function.md @@ -25,7 +25,7 @@ Finds a row in the group that minimizes the specified expression. It returns all | Name | Type | Required | Description | |--|--|--|--| -| *ExprToMinimize*| `string` | :heavy_check_mark: | The expression specifies the expression or column that you want to minimize. | +| *ExprToMinimize*| `string` | :heavy_check_mark: | The expression specifies column that you want to minimize. | | *ExprToReturn* | `string` | :heavy_check_mark: | The expression determines which columns' values are returned from the row that has the minimum value for *ExprToMinimize*. Use a wildcard `*` to return all columns. | ## Null handling @@ -164,12 +164,12 @@ Find the first time an event with a direct death happened. ```kusto StormEvents | where DeathsDirect > 0 -| summarize max(StartTime) +| summarize min(StartTime) ``` The results table returns the lowest value in the specific column only. -| max_StartTime | +| min_StartTime | | --- | | 2007-01-01T00:00:00Z | diff --git a/data-explorer/kusto/query/min-aggregation-function.md b/data-explorer/kusto/query/min-aggregation-function.md index 0232ddafa5..af2beecb42 100644 --- a/data-explorer/kusto/query/min-aggregation-function.md +++ b/data-explorer/kusto/query/min-aggregation-function.md @@ -23,7 +23,7 @@ Finds the minimum value of the expression in the group. | Name | Type | Required | Description | |--|--|--|--| -| *expr* | `string` | :heavy_check_mark: | The expression used for the minimum value aggregation calculation. | +| *expr* | `string` | :heavy_check_mark: | The expression specifies the column that you want to minimize. | ## Returns From df1938f3b0328d9a80891832ebc2f8f37eb0affa Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Thu, 14 Nov 2024 14:51:47 +0200 Subject: [PATCH 08/19] Updates from review comments --- .../query/arg-max-aggregation-function.md | 20 ++++++++++++------- .../query/arg-min-aggregation-function.md | 18 +++++++++++------ .../kusto/query/max-aggregation-function.md | 10 +++++----- .../kusto/query/min-aggregation-function.md | 8 ++++---- 4 files changed, 34 insertions(+), 22 deletions(-) diff --git a/data-explorer/kusto/query/arg-max-aggregation-function.md b/data-explorer/kusto/query/arg-max-aggregation-function.md index 1d71935960..0836615ea5 100644 --- a/data-explorer/kusto/query/arg-max-aggregation-function.md +++ b/data-explorer/kusto/query/arg-max-aggregation-function.md @@ -1,6 +1,6 @@ --- title: arg_max() (aggregation function) -description: Learn how to use the arg_max() aggregation function to find a row in a group that maximizes the input expression. +description: Learn how to use the arg_max() aggregation function to find a row in a table that maximizes the input expression. ms.reviewer: alexans ms.topic: reference ms.date: 11/11/2024 @@ -9,7 +9,7 @@ ms.date: 11/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds a row in the group that maximizes the specified expression. It returns all columns of the input table or specified columns. +Finds a row in the table that maximizes the specified expression. It returns all columns of the input table or specified columns. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -25,12 +25,12 @@ Finds a row in the group that maximizes the specified expression. It returns all | Name | Type | Required | Description | |--|--|--|--| -| *ExprToMaximize* | `string` | :heavy_check_mark: | The expression specifies the column that you want to maximize. | -| *ExprToReturn* | `string` | :heavy_check_mark: | The expression determines which columns' values are returned from the row that has the maximum value for *ExprToMaximize*. Use a wildcard `*` to return all columns. | +| *ExprToMaximize* | `string` | :heavy_check_mark: | The expression determines the row that contains the maximum value in the specifed column. | +| *ExprToReturn* | `string` | :heavy_check_mark: | The expression determines which columns' values are returned, from the row that has the maximum value for *ExprToMaximize*. Use a wildcard `*` to return all columns. | ## Returns -Returns a row in the group that maximizes the specified expression *ExprToMaximize*, and the values of columns specified in *ExprToReturn*. +Returns a row in the table that maximizes the specified expression *ExprToMaximize*, and the values of columns specified in *ExprToReturn*. > [!TIP] > To see the maximal value only, use the [max() function](max-aggregation-function.md). @@ -67,6 +67,8 @@ The results table displays only the first 10 rows. Find the last time an event with a direct death happened in each state, showing all the columns. +The query first filters the events to only include those where there was at least one direct death. Then the query returns the entire row with the most recent StartTime. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -131,6 +133,8 @@ The arg_max() function differs from the [max() function](max-aggregation-functio Find the last time an event with a direct death happened, showing all the columns in the table. +The query first filters the events to only include those where there was at least one direct death. Then the query returns the entire row with the most recent StartTime. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -152,6 +156,8 @@ The results table returns all the columns for the row containing the highest val Find the last time an event with a direct death happened. +The query filters events to only include those where there is at least one direct death, and then returns the maximum value for StartTime. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -163,7 +169,7 @@ StormEvents | summarize max(StartTime) ``` -The results table returns the highest value in the specific column only. +The results table returns the maximum value of StartTime, without returning other columns for this record. | max_StartTime | | --- | @@ -171,7 +177,7 @@ The results table returns the highest value in the specific column only. ## Related content -* [max fnction](max-aggregation-function.md) +* [max function](max-aggregation-function.md) * [min function](min-aggregation-function.md) * [avg function](avg-aggregation-function.md) * [percentile function](percentiles-aggregation-function.md) diff --git a/data-explorer/kusto/query/arg-min-aggregation-function.md b/data-explorer/kusto/query/arg-min-aggregation-function.md index 45db574db4..9c9077576b 100644 --- a/data-explorer/kusto/query/arg-min-aggregation-function.md +++ b/data-explorer/kusto/query/arg-min-aggregation-function.md @@ -1,6 +1,6 @@ --- title: arg_min() (aggregation function) -description: Learn how to use the arg_min() aggregation function to find a row in a group that minimizes the input expression. +description: Learn how to use the arg_min() aggregation function to find a row in a table that minimizes the input expression. ms.reviewer: alexans ms.topic: reference ms.date: 08/11/2024 @@ -9,7 +9,7 @@ ms.date: 08/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds a row in the group that minimizes the specified expression. It returns all columns of the input table or specified columns. +Finds a row in the table that minimizes the specified expression. It returns all columns of the input table or specified columns. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -25,16 +25,16 @@ Finds a row in the group that minimizes the specified expression. It returns all | Name | Type | Required | Description | |--|--|--|--| -| *ExprToMinimize*| `string` | :heavy_check_mark: | The expression specifies column that you want to minimize. | -| *ExprToReturn* | `string` | :heavy_check_mark: | The expression determines which columns' values are returned from the row that has the minimum value for *ExprToMinimize*. Use a wildcard `*` to return all columns. | +| *ExprToMinimize*| `string` | :heavy_check_mark: | The expression determines the row that contains the minimum value in the specifed column. | +| *ExprToReturn* | `string` | :heavy_check_mark: | The expression determines which columns' values are returned, from the row that has the minimum value for *ExprToMinimize*. Use a wildcard `*` to return all columns. | ## Null handling -When *ExprToMinimize* is null for all rows in a group, one row in the group is picked. Otherwise, rows where *ExprToMinimize* is null are ignored. +When *ExprToMinimize* is null for all rows in a table, one row in the table is picked. Otherwise, rows where *ExprToMinimize* is null are ignored. ## Returns -Returns a row in the group that minimizes *ExprToMinimize*, and the values of columns specified in *ExprToReturn*. Use or `*` to return the entire row. +Returns a row in the table that minimizes *ExprToMinimize*, and the values of columns specified in *ExprToReturn*. Use or `*` to return the entire row. > [!TIP] > To see the minimal value only, use the [min() function](min-aggregation-function.md). @@ -71,6 +71,8 @@ The results table shown includes only the first 10 rows. Find the first time an event with a direct death happened in each state, showing all of the columns. +The query first filters the events to only include those where there was at least one direct death. Then the query returns the entire row with the lowest value for StartTime. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -135,6 +137,8 @@ The arg_min() function differs from the [min() function](min-aggregation-functio Find the first time an event with a direct death happened, showing all the columns in the table. +The query first filters the events to only include those where there was at least one direct death. Then the query returns the entire row with the lowest value for StartTime. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query @@ -156,6 +160,8 @@ The results table returns all the columns for the row containing the lowest valu Find the first time an event with a direct death happened. +The query filters events to only include those where there is at least one direct death, and then returns the minimum value for StartTime. + :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] > Run the query diff --git a/data-explorer/kusto/query/max-aggregation-function.md b/data-explorer/kusto/query/max-aggregation-function.md index 6e16212e80..745e1a6056 100644 --- a/data-explorer/kusto/query/max-aggregation-function.md +++ b/data-explorer/kusto/query/max-aggregation-function.md @@ -1,6 +1,6 @@ --- title: max() (aggregation function) -description: Learn how to use the max() function to find the maximum value of the expression in the group. +description: Learn how to use the max() function to find the maximum value of the expression in the table. ms.reviewer: alexans ms.topic: reference ms.date: 11/11/2024 @@ -9,7 +9,7 @@ ms.date: 11/11/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds the maximum value of the expression in the group. +Finds the maximum value of the expression in the table. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -23,18 +23,18 @@ Finds the maximum value of the expression in the group. | Name | Type | Required | Description | |--|--|--|--| -| *expr* | `string` | :heavy_check_mark: | The expression specifies the column that you want to maximize. | +| *expr* | `string` | :heavy_check_mark: | The expression determines the maximum value in the specifed column. | ## Returns -Returns the value in the group that maximizes the specified expression. +Returns the value in the table that maximizes the specified expression. > [!TIP] > This gives you the max on its own. If you want to see other columns in addition to the max, use [arg_max](arg-max-aggregation-function.md). ## Example -This example returns the last record in a table. +This example returns the last record in a table by querying the maximum value for StartTime. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] diff --git a/data-explorer/kusto/query/min-aggregation-function.md b/data-explorer/kusto/query/min-aggregation-function.md index af2beecb42..2fb6f1b1f4 100644 --- a/data-explorer/kusto/query/min-aggregation-function.md +++ b/data-explorer/kusto/query/min-aggregation-function.md @@ -1,6 +1,6 @@ --- title: min() (aggregation function) -description: Learn how to use the min() function to find the minimum value in a group. +description: Learn how to use the min() function to find the minimum value in a table. ms.reviewer: alexans ms.topic: reference ms.date: 11/12/2024 @@ -9,7 +9,7 @@ ms.date: 11/12/2024 > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Finds the minimum value of the expression in the group. +Finds the minimum value of the expression in the table. [!INCLUDE [data-explorer-agg-function-summarize-note](../includes/agg-function-summarize-note.md)] @@ -23,11 +23,11 @@ Finds the minimum value of the expression in the group. | Name | Type | Required | Description | |--|--|--|--| -| *expr* | `string` | :heavy_check_mark: | The expression specifies the column that you want to minimize. | +| *expr* | `string` | :heavy_check_mark: | The expression determines the minimum value in the specifed column. | ## Returns -Returns the minimum value of *expr* across the group. +Returns the minimum value of *expr* across the table. > [!TIP] > This gives you the min on its own. If you want to see other columns in addition to the min, use [arg_min](arg-min-aggregation-function.md). From 114acf71a1c5e9a4bcfa306a4b21b908454d88da Mon Sep 17 00:00:00 2001 From: Andy Kopelowitz <165172502+AndyKop@users.noreply.github.com> Date: Sun, 24 Nov 2024 10:39:48 +0200 Subject: [PATCH 09/19] Update data-explorer/kusto/query/min-aggregation-function.md Co-authored-by: Yael Schuster-Davidi <62833511+YaelSchuster@users.noreply.github.com> --- data-explorer/kusto/query/min-aggregation-function.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data-explorer/kusto/query/min-aggregation-function.md b/data-explorer/kusto/query/min-aggregation-function.md index 2fb6f1b1f4..255a07d712 100644 --- a/data-explorer/kusto/query/min-aggregation-function.md +++ b/data-explorer/kusto/query/min-aggregation-function.md @@ -23,7 +23,7 @@ Finds the minimum value of the expression in the table. | Name | Type | Required | Description | |--|--|--|--| -| *expr* | `string` | :heavy_check_mark: | The expression determines the minimum value in the specifed column. | +| *expr* | `string` | :heavy_check_mark: | The expression for which the minimum value is determined. | ## Returns From 1031cd38a748631e4644bfd401ad6033c2e269f9 Mon Sep 17 00:00:00 2001 From: Andy Kopelowitz <165172502+AndyKop@users.noreply.github.com> Date: Sun, 24 Nov 2024 10:39:56 +0200 Subject: [PATCH 10/19] Update data-explorer/kusto/query/max-aggregation-function.md Co-authored-by: Yael Schuster-Davidi <62833511+YaelSchuster@users.noreply.github.com> --- data-explorer/kusto/query/max-aggregation-function.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data-explorer/kusto/query/max-aggregation-function.md b/data-explorer/kusto/query/max-aggregation-function.md index 745e1a6056..4df6fe5326 100644 --- a/data-explorer/kusto/query/max-aggregation-function.md +++ b/data-explorer/kusto/query/max-aggregation-function.md @@ -23,7 +23,7 @@ Finds the maximum value of the expression in the table. | Name | Type | Required | Description | |--|--|--|--| -| *expr* | `string` | :heavy_check_mark: | The expression determines the maximum value in the specifed column. | +| *expr* | `string` | :heavy_check_mark: | The expression for which the maximum value is determined. | ## Returns From 5cd4b831ab8a77c98c643adbe61f16e60db2f0a1 Mon Sep 17 00:00:00 2001 From: Andy Kopelowitz <165172502+AndyKop@users.noreply.github.com> Date: Sun, 24 Nov 2024 10:40:09 +0200 Subject: [PATCH 11/19] Update data-explorer/kusto/query/arg-max-aggregation-function.md Co-authored-by: Yael Schuster-Davidi <62833511+YaelSchuster@users.noreply.github.com> --- data-explorer/kusto/query/arg-max-aggregation-function.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data-explorer/kusto/query/arg-max-aggregation-function.md b/data-explorer/kusto/query/arg-max-aggregation-function.md index 0836615ea5..e54cac8a39 100644 --- a/data-explorer/kusto/query/arg-max-aggregation-function.md +++ b/data-explorer/kusto/query/arg-max-aggregation-function.md @@ -25,7 +25,7 @@ Finds a row in the table that maximizes the specified expression. It returns all | Name | Type | Required | Description | |--|--|--|--| -| *ExprToMaximize* | `string` | :heavy_check_mark: | The expression determines the row that contains the maximum value in the specifed column. | +| *ExprToMaximize* | `string` | :heavy_check_mark: | The expression for which the maximum value is determined. | | *ExprToReturn* | `string` | :heavy_check_mark: | The expression determines which columns' values are returned, from the row that has the maximum value for *ExprToMaximize*. Use a wildcard `*` to return all columns. | ## Returns From c357ab4994ecb33cba2ad3a1158d0720e5f842a9 Mon Sep 17 00:00:00 2001 From: Andy Kopelowitz <165172502+AndyKop@users.noreply.github.com> Date: Sun, 24 Nov 2024 10:40:16 +0200 Subject: [PATCH 12/19] Update data-explorer/kusto/query/arg-min-aggregation-function.md Co-authored-by: Yael Schuster-Davidi <62833511+YaelSchuster@users.noreply.github.com> --- data-explorer/kusto/query/arg-min-aggregation-function.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data-explorer/kusto/query/arg-min-aggregation-function.md b/data-explorer/kusto/query/arg-min-aggregation-function.md index 9c9077576b..bfb9501015 100644 --- a/data-explorer/kusto/query/arg-min-aggregation-function.md +++ b/data-explorer/kusto/query/arg-min-aggregation-function.md @@ -25,7 +25,7 @@ Finds a row in the table that minimizes the specified expression. It returns all | Name | Type | Required | Description | |--|--|--|--| -| *ExprToMinimize*| `string` | :heavy_check_mark: | The expression determines the row that contains the minimum value in the specifed column. | +| *ExprToMinimize*| `string` | :heavy_check_mark: | The expression for which the minimum value is determined. | | *ExprToReturn* | `string` | :heavy_check_mark: | The expression determines which columns' values are returned, from the row that has the minimum value for *ExprToMinimize*. Use a wildcard `*` to return all columns. | ## Null handling From 98461adbf0b9a86fdb85b8b07f0463df03e3831c Mon Sep 17 00:00:00 2001 From: Andy Kopelowitz <165172502+AndyKop@users.noreply.github.com> Date: Sun, 24 Nov 2024 10:40:25 +0200 Subject: [PATCH 13/19] Update data-explorer/kusto/query/arg-max-aggregation-function.md Co-authored-by: Yael Schuster-Davidi <62833511+YaelSchuster@users.noreply.github.com> --- data-explorer/kusto/query/arg-max-aggregation-function.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data-explorer/kusto/query/arg-max-aggregation-function.md b/data-explorer/kusto/query/arg-max-aggregation-function.md index e54cac8a39..498d1151e7 100644 --- a/data-explorer/kusto/query/arg-max-aggregation-function.md +++ b/data-explorer/kusto/query/arg-max-aggregation-function.md @@ -133,7 +133,7 @@ The arg_max() function differs from the [max() function](max-aggregation-functio Find the last time an event with a direct death happened, showing all the columns in the table. -The query first filters the events to only include those where there was at least one direct death. Then the query returns the entire row with the most recent StartTime. +The query first filters the events to only include those where there was at least one direct death. Then the query returns the entire row with the most recent (maximum) StartTime. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] From 70eece32fbb681213c78e84b503c016b5b9f33b4 Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Wed, 27 Nov 2024 11:25:20 +0200 Subject: [PATCH 14/19] Add more complex example --- data-explorer/kusto/query/iff-function.md | 25 +++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/data-explorer/kusto/query/iff-function.md b/data-explorer/kusto/query/iff-function.md index ae98844b26..da3c051e6c 100644 --- a/data-explorer/kusto/query/iff-function.md +++ b/data-explorer/kusto/query/iff-function.md @@ -3,7 +3,7 @@ title: iff() description: This article describes iff(). ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 11/27/2024 --- # iff() @@ -31,7 +31,11 @@ Returns the *:::no-loc text="then":::* value when the *:::no-loc text="if":::* c This function returns the *:::no-loc text="then":::* value when the *:::no-loc text="if":::* condition evaluates to `true`, otherwise it returns the *:::no-loc text="else":::* value. -## Example +## Examples + +### *Then-if* example + +This query adds a new column called Rain to the StormEvents table. The Rain column indicates whether the event is a "Rain event" or "Not rain event". A rain event is defined as heavy rain, flash flood events or flood events. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -56,3 +60,20 @@ The following table shows only the first five rows. |GEORGIA| 64588 |Thunderstorm Wind |Not rain event| |MISSISSIPPI| 68796 |Thunderstorm Wind |Not rain event| |...|...|...|...| + +### Combine iff() with other functions + +The following query defines the severity of an event. The level of severity depends on the total value of damages, the number of injuries and the number of direct deaths associated with each event. The severity level is Low in cases where there are zero deaths, zero injuries, and damages of less than $50,000. Moderate severity results from zero deaths, less than 10 injuries or damages between $50,000 and $1,000,000. The severity level is High in cases where there is a direct death, more than 10 injuries, or damages above $1,000,000. The query then returns the number of events for each level of severity. + +:::moniker range="azure-data-explorer" +> [!div class="nextstepaction"] +> Run the query +::: moniker-end + + +```kusto +StormEvents +| extend TotalDamage = DamageCrops + DamageProperty +| extend Severity = iff(TotalDamage > 1000000 or InjuriesDirect > 10 or DeathsDirect > 0, "High", iff(TotalDamage < 50000 and InjuriesDirect == 0 and DeathsDirect == 0, "Low", "Moderate")) +| summarize TotalEvents = count(), SeverityEvents = count() by Severity +``` From a31f84f41dbd14e12fbe5c7a2fcfb01fbb3580fe Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Wed, 27 Nov 2024 11:31:28 +0200 Subject: [PATCH 15/19] Tweaks to examples, added output table --- data-explorer/kusto/query/iff-function.md | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/data-explorer/kusto/query/iff-function.md b/data-explorer/kusto/query/iff-function.md index da3c051e6c..e8b8c869a2 100644 --- a/data-explorer/kusto/query/iff-function.md +++ b/data-explorer/kusto/query/iff-function.md @@ -33,7 +33,7 @@ This function returns the *:::no-loc text="then":::* value when the *:::no-loc ## Examples -### *Then-if* example +### Classify data using iff() This query adds a new column called Rain to the StormEvents table. The Rain column indicates whether the event is a "Rain event" or "Not rain event". A rain event is defined as heavy rain, flash flood events or flood events. @@ -67,13 +67,20 @@ The following query defines the severity of an event. The level of severity depe :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] -> Run the query +> Run the query ::: moniker-end - ```kusto StormEvents | extend TotalDamage = DamageCrops + DamageProperty | extend Severity = iff(TotalDamage > 1000000 or InjuriesDirect > 10 or DeathsDirect > 0, "High", iff(TotalDamage < 50000 and InjuriesDirect == 0 and DeathsDirect == 0, "Low", "Moderate")) | summarize TotalEvents = count(), SeverityEvents = count() by Severity ``` + +**Output** + +| Severity | TotalEvents | +|----------|-------------| +| Low | 54805 | +| High | 977 | +| Moderate | 3284 | From 387b3cac6c793658bbb002922278fcecbf49f0b6 Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Wed, 27 Nov 2024 11:43:55 +0200 Subject: [PATCH 16/19] Edits --- data-explorer/kusto/query/iff-function.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data-explorer/kusto/query/iff-function.md b/data-explorer/kusto/query/iff-function.md index e8b8c869a2..c001d795bb 100644 --- a/data-explorer/kusto/query/iff-function.md +++ b/data-explorer/kusto/query/iff-function.md @@ -35,7 +35,7 @@ This function returns the *:::no-loc text="then":::* value when the *:::no-loc ### Classify data using iff() -This query adds a new column called Rain to the StormEvents table. The Rain column indicates whether the event is a "Rain event" or "Not rain event". A rain event is defined as heavy rain, flash flood events or flood events. +This query adds a new column called Rain to the StormEvents table. The Rain column indicates whether the event is considered a rain event or not. A rain event is defined as EventType Heavy Rain, Flash Flood or Flood. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] From 6b959cfd59b0c06c32d22b67fea49e333ed6120f Mon Sep 17 00:00:00 2001 From: Andy Kopelowitz <165172502+AndyKop@users.noreply.github.com> Date: Thu, 28 Nov 2024 12:16:09 +0200 Subject: [PATCH 17/19] Update data-explorer/kusto/query/iff-function.md Co-authored-by: Shlomo Sagir <51323195+shsagir@users.noreply.github.com> --- data-explorer/kusto/query/iff-function.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data-explorer/kusto/query/iff-function.md b/data-explorer/kusto/query/iff-function.md index c001d795bb..2bc59aeb7a 100644 --- a/data-explorer/kusto/query/iff-function.md +++ b/data-explorer/kusto/query/iff-function.md @@ -35,7 +35,7 @@ This function returns the *:::no-loc text="then":::* value when the *:::no-loc ### Classify data using iff() -This query adds a new column called Rain to the StormEvents table. The Rain column indicates whether the event is considered a rain event or not. A rain event is defined as EventType Heavy Rain, Flash Flood or Flood. +The following query uses the `iff()` function to categorize storm events as either "Rain event" or "Not rain event" based on their event type, and then projects the state, event ID, event type, and the new rain category. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] From c2a8fbe14190594f7e6fbfaa3e0fbd91b71011e0 Mon Sep 17 00:00:00 2001 From: Andy Kopelowitz <165172502+AndyKop@users.noreply.github.com> Date: Thu, 28 Nov 2024 12:16:36 +0200 Subject: [PATCH 18/19] Update data-explorer/kusto/query/iff-function.md Co-authored-by: Shlomo Sagir <51323195+shsagir@users.noreply.github.com> --- data-explorer/kusto/query/iff-function.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data-explorer/kusto/query/iff-function.md b/data-explorer/kusto/query/iff-function.md index 2bc59aeb7a..c09e37ca97 100644 --- a/data-explorer/kusto/query/iff-function.md +++ b/data-explorer/kusto/query/iff-function.md @@ -63,7 +63,7 @@ The following table shows only the first five rows. ### Combine iff() with other functions -The following query defines the severity of an event. The level of severity depends on the total value of damages, the number of injuries and the number of direct deaths associated with each event. The severity level is Low in cases where there are zero deaths, zero injuries, and damages of less than $50,000. Moderate severity results from zero deaths, less than 10 injuries or damages between $50,000 and $1,000,000. The severity level is High in cases where there is a direct death, more than 10 injuries, or damages above $1,000,000. The query then returns the number of events for each level of severity. +The following query calculates the total damage from crops and property, categorizes the severity of storm events based on total damage, direct injuries, and direct deaths, and then summarizes the total number of events and the number of events by severity. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] From 58b48c9b7ebf0a44ad62d719ad0c1ad6ab34a96d Mon Sep 17 00:00:00 2001 From: andykop <165172502+AndyKop@users.noreply.github.com> Date: Thu, 28 Nov 2024 14:27:27 +0200 Subject: [PATCH 19/19] added related content links --- data-explorer/kusto/query/iff-function.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/data-explorer/kusto/query/iff-function.md b/data-explorer/kusto/query/iff-function.md index c001d795bb..4a4acd91ca 100644 --- a/data-explorer/kusto/query/iff-function.md +++ b/data-explorer/kusto/query/iff-function.md @@ -84,3 +84,10 @@ StormEvents | Low | 54805 | | High | 977 | | Moderate | 3284 | + +## Related content + +* [Scalar function types summary](scalar-functions.md) +* [array_iff()](array-iff-function.md) +* [bin()](bin-function.md) +* [extend operator](extend-operator.md)