arg_min() (aggregation function)
Finds a row in the group that minimizes ExprToMinimize, and returns the value of ExprToReturn (or * to return the entire row).
- Can be used only in context of aggregation inside summarize
Syntax
arg_min (ExprToMinimize, * | ExprToReturn [, ...])
Arguments
-
ExprToMinimize: Expression that will be used for aggregation calculation.
-
ExprToReturn: Expression that will be used for returning the value when ExprToMinimize is minimum.
Note
Currently no Expression to return may be a wildcard (*) to return all columns of the input table is not supported.
Null handling
When ExprToMinimize is null for all rows in a group, one row in the group is picked. Otherwise, rows where ExprToMinimize is null are ignored.
Returns
Finds a row in the group that minimizes ExprToMinimize, and returns the value of ExprToReturn (or * to return the entire row).
Examples
To show the least occuring event and corresonding data source :
events
| project arg_min(name, data_source_name)
| take 1
Results
| data_source_name | Column1 |
|---|---|
| ciscoASASource1 | (Primary) Failover cable OK |