distinct operator
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Produces a table with the distinct combination of the provided columns of the input table.
Syntax
T | distinct ColumnName[,ColumnName2, ...]
Learn more about syntax conventions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| ColumnName | string |
✔️ | The column name to search for distinct values. |
Note
The distinct operator supports providing an asterisk * as the group key to denote all columns, which is helpful for wide tables.
Example
Shows distinct combination of states and type of events that led to over 45 direct injuries.
StormEvents
| where InjuriesDirect > 45
| distinct State, EventType
Output
| State | EventType |
|---|---|
| TEXAS | Winter Weather |
| KANSAS | Tornado |
| MISSOURI | Excessive Heat |
| OKLAHOMA | Thunderstorm Wind |
| OKLAHOMA | Excessive Heat |
| ALABAMA | Tornado |
| ALABAMA | Heat |
| TENNESSEE | Heat |
| CALIFORNIA | Wildfire |
Related content
If the group by keys are of high cardinalities, try summarize by ... with the shuffle strategy.