Aggregate FunctionsArg
arg_max
Returns both the maximum value and the corresponding return expression from the row where the first expression is maximum.
Output column naming follows Microsoft Kusto:
- The single alias (or the source column name if unaliased) is used only for the key column.
winner = arg_max(score, name)→ columnswinner:long,name:string. - Each value column is named after the underlying source column when the
expression is a plain column reference or a simple unary call
(
todouble(v),bin(v, 1)→v); otherwise it is namedmax_<keyname>_arg<N>(1-based value-arg index). - Tuple assignment names each output column explicitly:
(max_score, winner) = arg_max(score, name)→max_score:long,winner:string. *expands to every non-key column with its own name and type.
Duplicate names across multiple aggregates are disambiguated by appending 1, 2, …:
arg_max(score, name), arg_min(score, name) → score, name, score1, name1.
Output column types match the inferred types of each argument expression.
Syntax
arg_max(maximize, return_expr)Parameters
Prop
Type
Returns: any
Syntax
arg_max(maximize, return_expr)Parameters
Prop
Type
Returns: any
Examples
Example 1
datatable(clan:string, warrior:string, voyages:long)[
"Lothbrok", "Ragnar", 42,
"Lothbrok", "Bjorn", 31,
"Fairhair", "Harald", 25,
"Lothbrok", "Ivar", 35
]
| summarize arg_max(voyages, warrior) by clan| clan (string) | voyages (long) | warrior (string) |
|---|---|---|
| Fairhair | 25 | Harald |
| Lothbrok | 42 | Ragnar |
Example 2
datatable(region:string, raid:string, loot:long)[
"England", "Lindisfarne", 500,
"England", "York", 1200,
"Francia", "Paris", 7000,
"Francia", "Rouen", 3000
]
| summarize (best_loot, best_raid) = arg_max(loot, raid) by region| region (string) | best_loot (long) | best_raid (string) |
|---|---|---|
| England | 1200 | York |
| Francia | 7000 | Paris |