Kusto Query Language (KQL) - Summarize Operator

Basic Syntax:

The basic syntax for the summarize operator is as follows:

TableName
| summarize [AggregationFunction(Column)] [, ...] by [GroupingColumn] [, ...]
    

• TableName: Specifies the name of the table you want to summarize.
• AggregationFunction(Column): Specifies the aggregation functions you want to apply to one or more columns.
• GroupingColumn: Specifies the columns by which you want to group the data for summarization.

Common Use Cases:

1. Aggregating Data:

The primary purpose of the summarize operator is to aggregate data by applying aggregation functions like count(), sum(), avg(), etc., to one or more columns.

MyTable
| summarize TotalSales = sum(SalesAmount)
    

2. Grouped Summarization:

You can use the by clause to group data based on one or more columns and then apply aggregation functions within each group.

MyTable
| summarize TotalSales = sum(SalesAmount) by ProductCategory
    

3. Multiple Aggregations:

You can apply multiple aggregation functions to different columns within the same summarize statement to retrieve various summary statistics in a single query.

MyTable
| summarize TotalSales = sum(SalesAmount), AvgPrice = avg(Price) by ProductCategory
    

4. Custom Aggregations:

With summarize, you can create custom aggregations or calculated columns using expressions.

MyTable
| summarize TotalSales = sum(SalesAmount), ProfitMargin = sum(Profit) / sum(SalesAmount) by ProductCategory
    

The summarize operator is a powerful tool for summarizing and aggregating data in Kusto Query Language, allowing you to obtain meaningful insights from your datasets.