GitHubContribute in GitHub: Edit online

arg_min() (aggregation function)

Finds a row in the group that minimizes ExprToMinimize, and returns the value of ExprToReturn (or * to return the entire row).

  • Can be used only in context of aggregation inside summarize

Syntax

arg_min (ExprToMinimize, * | ExprToReturn [, ...])

Arguments

  • ExprToMinimize: Expression that will be used for aggregation calculation.

  • ExprToReturn: Expression that will be used for returning the value when ExprToMinimize is minimum.

    Note

    Currently no Expression to return may be a wildcard (*) to return all columns of the input table is not supported.

Null handling

When ExprToMinimize is null for all rows in a group, one row in the group is picked. Otherwise, rows where ExprToMinimize is null are ignored.

Returns

Finds a row in the group that minimizes ExprToMinimize, and returns the value of ExprToReturn (or * to return the entire row).

Examples

To show the least occuring event and corresonding data source :

events
| project arg_min(name, data_source_name)
| take 1

Results

data_source_name Column1
ciscoASASource1 (Primary) Failover cable OK