Aggregate FunctionsMake / Collect
make_list_if
Returns a dynamic (JSON) array of values of `expr` for the rows in the group where `predicate` is true.
Unlike make_set_if, duplicates are preserved and
ingest order is kept. Equivalent to
make_list(iff(predicate, expr, dynamic(null))) but registered as an
aggregate so it composes with summarize directly and avoids the cost of
evaluating iff per row.
Like make_list, nulls are skipped, and the result is truncated to
max_size values (default 1,048,576).
Syntax
make_list_if(expr, predicate)Parameters
Prop
Type
Returns: dynamic
Syntax
make_list_if(expr, predicate, max_size)Parameters
Prop
Type
Returns: dynamic
Syntax
make_list_if(expr, predicate, max_size)Parameters
Prop
Type
Returns: dynamic
Examples
Example 1
datatable(warrior:string, region:string, survived:bool)[
"Ragnar", "Kattegat", true,
"Bjorn", "Kattegat", true,
"Floki", "Kattegat", false,
"Ivar", "Kattegat", true,
"Harald", "Vestfold", true,
"Halfdan", "Vestfold", false
]
| summarize survivors = make_list_if(warrior, survived) by region| region (string) | survivors (dynamic) |
|---|---|
| Kattegat | ["Ragnar","Bjorn","Ivar"] |
| Vestfold | ["Harald"] |
Example 2
datatable(event:string, level:string)[
"user_login", "info",
"db_connect_failed", "error",
"cache_miss", "warn",
"auth_token_expired", "error",
"request_handled", "info"
]
| summarize errors = make_list_if(event, level == "error")| errors (dynamic) |
|---|
| ["db_connect_failed","auth_token_expired"] |