partition
Partitions the input by the values of a single column and runs a subquery independently over each partition, returning the union of the per-partition results.
The key must be a bare column reference. To partition on a computed value, materialize it first with extend:
| extend tb = bin(timestamp, 1m)
| partition by tb (top 1 by value desc)The output schema is the subquery's output schema verbatim — the key column is not added back. A subquery that wants the key must select it.
Rows are routed to a per-partition reducer, so partition is itself a reducer: everything after it operates on the union of the per-partition results.
The row-window functions (row_number, prev, next, row_cumsum, row_rank_min, row_rank_dense) work inside the subquery and are evaluated per partition — row_number() restarts at 1 for each key, and prev() is null at each key's first row. No serialize is needed: the first operator that requires an order gets one, on timestamp ascending. A sort or top written inside the subquery establishes the order itself and is not overridden.
| partition by tenant (sort by latency desc | extend rank = row_number() | where rank <= 3)Inside the subquery, a table source and a second reduction step (join, fork, trace-find, vsearch, a nested partition) are rejected.
Syntax
partition by column (subquery)Run the subquery once per distinct value of the key column
Parameters
| Name | Description |
|---|---|
| column | Bare column reference whose distinct values define the partitions |
| subquery | Query applied independently to each partition |
Examples
Example 1
datatable(jarl:string, raids:long)[
"Erik", 100,
"Erik", 50,
"Erik", 200,
"Olaf", 300,
"Olaf", 150
]
| partition by jarl (top 1 by raids desc)| jarl (string) | raids (long) |
|---|---|
| Erik | 200 |
| Olaf | 300 |
Example 2
datatable(ship:string, oars:long)[
"Naglfar", 30,
"Naglfar", 40,
"Wave Rider", 20
]
| partition by ship (summarize total = sum(oars))| total (long) |
|---|
| 20 |
| 70 |