distinct operator

Applies to: ✅ Azure Data ExplorerAzure MonitorMicrosoft Sentinel

Produces a table with the distinct combination of the provided columns of the input table.

Syntax

T | distinct ColumnName[,ColumnName2, ...]

Learn more about syntax conventions.

Parameters

Name Type Required Description
ColumnName string ✔️ The column name to search for distinct values.

Note

The distinct operator supports providing an asterisk * as the group key to denote all columns, which is helpful for wide tables.

Example

Shows distinct combination of states and type of events that led to over 45 direct injuries.

StormEvents
| where InjuriesDirect > 45
| distinct State, EventType

Output

State EventType
TEXAS Winter Weather
KANSAS Tornado
MISSOURI Excessive Heat
OKLAHOMA Thunderstorm Wind
OKLAHOMA Excessive Heat
ALABAMA Tornado
ALABAMA Heat
TENNESSEE Heat
CALIFORNIA Wildfire

If the group by keys are of high cardinalities, try summarize by ... with the shuffle strategy.