rank_tdigest()

Applies to: ✅ Azure Data ExplorerAzure MonitorMicrosoft Sentinel

Calculates the approximate rank of the value in a set. Rank of value v in a set S is defined as count of members of S that are smaller or equal to v, S is represented by its tdigest.

Syntax

rank_tdigest(digest, value)

Learn more about syntax conventions.

Parameters

Name Type Required Description
digest string An expression that was generated by tdigest() or tdigest_merge().
value scalar An expression representing a value to be used for ranking calculation.

Returns

The rank foreach value in a dataset.

Tip

The values that you want to get its rank must be of the same type as the tdigest.

Examples

In a sorted list (1-1000), the rank of 685 is its index:

range x from 1 to 1000 step 1
| summarize t_x=tdigest(x)
| project rank_of_685=rank_tdigest(t_x, 685)

Output

rank_of_685
685

This query calculates the rank of value 4490$ over all damage properties costs:

StormEvents
| summarize tdigestRes = tdigest(DamageProperty)
| project rank_of_4490=rank_tdigest(tdigestRes, 4490) 

Output

rank_of_4490
50207

Getting the estimated percentage of the rank (by dividing by the set size):

StormEvents
| summarize tdigestRes = tdigest(DamageProperty), count()
| project rank_tdigest(tdigestRes, 4490) * 100.0 / count_

Output

Column1
85.0015237192293

The percentile 85 of the damage properties costs is 4490$:

StormEvents
| summarize tdigestRes = tdigest(DamageProperty)
| project percentile_tdigest(tdigestRes, 85, typeof(long))

Output

percentile_tdigest_tdigestRes
4490