percentile_tdigest()

  • Article

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Calculates the percentile result from the tdigest results (which was generated by tdigest() or tdigest_merge())

Syntax

percentile_tdigest(expr, percentile1 , typeLiteral)

Learn more about syntax conventions.

Parameters

Name Type Required Description
expr string ✔️ An expression that was generated by tdigest or tdigest_merge().
percentile long ✔️ The value that specifies the percentile.
typeLiteral string A type literal. If provided, the result set will be of this type. For example, typeof(long) will cast all results to type long.

Returns

The percentile value of each value in expr.

Tip

  • If the type was provided, the result will be a column of the same type provided with the results of the percentile. In this case, all tdigest functions must be of that type.
  • If expr includes tdigest functions of different types, don't provide the type. The result will be of type dynamic. See below examples.

Examples

StormEvents
| summarize tdigestRes = tdigest(DamageProperty) by State
| project percentile_tdigest(tdigestRes, 100)

Output

percentile_tdigest_tdigestRes
0
62000000
110000000
1200000
250000 
StormEvents
| summarize tdigestRes = tdigest(DamageProperty) by State
| union (StormEvents | summarize tdigestRes = tdigest(EndTime) by State)
| project percentile_tdigest(tdigestRes, 100)

Output

percentile_tdigest_tdigestRes
[0]
[62000000]
["2007-12-20T11:30:00.0000000Z"]
["2007-12-31T23:59:00.0000000Z"]