Contribute in GitHub:

make_list() (aggregation function)

Returns a dynamic (JSON) array of all the values of Expr in the group.

Can be used only in context of aggregation inside summarize

Syntax

make_list (Expr [, MaxSize])

Arguments

Expr: Expression that will be used for aggregation calculation.
MaxSize is an optional integer limit on the maximum number of elements returned (default is 1048576). MaxSize value cannot exceed 1048576.

Returns

Returns a dynamic (JSON) array of all the values of Expr in the group. If the input to the summarize operator is not sorted, the order of elements in the resulting array is undefined. If the input to the summarize operator is sorted, the order of elements in the resulting array tracks that of the input.

[!TIP] Use the array_sort_asc() or array_sort_desc() function to create an ordered list by some key.

Examples

One column

The simplest example is to make a list out of a single column:

let shapes = datatable (name: string, sideCount: int)
[
    "triangle", 3,
    "square", 4,
    "rectangle", 4,
    "pentagon", 5,
    "hexagon", 6,
    "heptagon", 7,
    "octogon", 8,
    "nonagon", 9,
    "decagon", 10
];
shapes
| summarize mylist = make_list(name)

mylist
["triangle","square","rectangle","pentagon","hexagon","heptagon","octogon","nonagon","decagon"]

Using the 'by' clause

In the following query, you group using the by clause:

let shapes = datatable (name: string, sideCount: int)
[
    "triangle", 3,
    "square", 4,
    "rectangle", 4,
    "pentagon", 5,
    "hexagon", 6,
    "heptagon", 7,
    "octogon", 8,
    "nonagon", 9,
    "decagon", 10
];
shapes
| summarize mylist = make_list(name) by isEvenSideCount = sideCount % 2 == 0

isEvenSideCount	mylist
false	["triangle","pentagon","heptagon","nonagon"]
true	["square","rectangle","hexagon","octogon","decagon"]