Aggregate FunctionsMake / Collect
make_list_if
Returns a dynamic (JSON) array of values of `expr` for the rows in the group
Syntax
make_list_if(expr, predicate)Parameters
Prop
Type
Returns: dynamic
Syntax
make_list_if(expr, predicate, max_size)Parameters
Prop
Type
Returns: dynamic
Syntax
make_list_if(expr, predicate, max_size)Parameters
Prop
Type
Returns: dynamic
Examples
Example 1
datatable(warrior:string, region:string, survived:bool)[
"Ragnar", "Kattegat", true,
"Bjorn", "Kattegat", true,
"Floki", "Kattegat", false,
"Ivar", "Kattegat", true,
"Harald", "Vestfold", true,
"Halfdan", "Vestfold", false
]
| summarize survivors = make_list_if(warrior, survived) by region| region (string) | survivors (dynamic) |
|---|---|
| Kattegat | ["Ragnar","Bjorn","Ivar"] |
| Vestfold | ["Harald"] |
Example 2
datatable(event:string, level:string)[
"user_login", "info",
"db_connect_failed", "error",
"cache_miss", "warn",
"auth_token_expired", "error",
"request_handled", "info"
]
| summarize errors = make_list_if(event, level == "error")| errors (dynamic) |
|---|
| ["db_connect_failed","auth_token_expired"] |