sum() (aggregation function)

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Calculates the sum of expr across the group.

Null values are ignored and don't factor into the calculation.

Note

This function is used in conjunction with the summarize operator.

Syntax

sum(expr)

Name	Type	Required	Description
expr string	✔️	The expression used for the aggregation calculation.

Returns the sum value of expr across the group.

This example returns the total number of deaths by state.

StormEvents 
| summarize EventCount=count(), TotalDeathCases = sum(DeathsDirect) by State 
| sort by TotalDeathCases

Output

The results table shown includes only the first 10 rows.