hll_if() (aggregation function)

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Calculates the intermediate results of dcount in records for which the predicate evaluates to true.

Read about the underlying algorithm (HyperLogLog) and the estimation accuracy.

Note

This function is used in conjunction with the summarize operator.

Important

The results of hll(), hll_if(), and hll_merge() can be stored and later retrieved. For example, you may want to create a daily unique users summary, which can then be used to calculate weekly counts. However, the precise binary representation of these results may change over time. There's no guarantee that these functions will produce identical results for identical inputs, and therefore we don't advise relying on them.

Syntax

hll_if (expr, predicate [, accuracy])

Learn more about syntax conventions.

Parameters

Name Type Required Description
expr string ✔️ The expression used for the aggregation calculation.
predicate string ✔️ The Expr used to filter records to add to the intermediate result of dcount.
accuracy int The value that controls the balance between speed and accuracy. If unspecified, the default value is 1. For supported values, see Estimation accuracy.

Returns

Returns the intermediate results of distinct count of Expr for which Predicate evaluates to true.

Tip

  • You can use the aggregation function hll_merge to merge more than one hll intermediate result. Only works with hll output only.
  • You can use dcount_hll, to calculate the distinct count from hll,hll_merge, or hll_if aggregation functions.

Examples

StormEvents
| where State in ("IOWA", "KANSAS")
| summarize hll_flood = hll_if(Source, EventType == "Flood") by State
| project State, SourcesOfFloodEvents = dcount_hll(hll_flood)
State SourcesOfFloodEvents
KANSAS 11
IOWA 7

Estimation accuracy

Accuracy Speed Error (%)
0 Fastest 1.6
1 Balanced 0.8
2 Slow 0.4
3 Slow 0.28
4 Slowest 0.2