hll_if() (aggregation function)
Calculates the intermediate results of dcount in records for which the predicate evaluates to true.
Read about the underlying algorithm (HyperLogLog) and the estimation accuracy.
Note
This function is used in conjunction with the summarize operator.
Important
The results of hll(), hll_if(), and hll_merge() can be stored and later retrieved. For example, you may want to create a daily unique users summary, which can then be used to calculate weekly counts. However, the precise binary representation of these results may change over time. There's no guarantee that these functions will produce identical results for identical inputs, and therefore we don't advise relying on them.
Syntax
hll_if (expr, predicate [, accuracy])
Learn more about syntax conventions.
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| expr | string |
✔️ | The expression used for the aggregation calculation. |
| predicate | string |
✔️ | The Expr used to filter records to add to the intermediate result of dcount. |
| accuracy | int |
The value that controls the balance between speed and accuracy. If unspecified, the default value is 1. For supported values, see Estimation accuracy. |
Returns
Returns the intermediate results of distinct count of Expr for which Predicate evaluates to true.
Tip
- You can use the aggregation function
hll_mergeto merge more than onehllintermediate result. Only works withhlloutput only. - You can use
dcount_hll, to calculate the distinct count fromhll,hll_merge, orhll_ifaggregation functions.
Examples
StormEvents
| where State in ("IOWA", "KANSAS")
| summarize hll_flood = hll_if(Source, EventType == "Flood") by State
| project State, SourcesOfFloodEvents = dcount_hll(hll_flood)
| State | SourcesOfFloodEvents |
|---|---|
| KANSAS | 11 |
| IOWA | 7 |
Estimation accuracy
| Accuracy | Speed | Error (%) |
|---|---|---|
| 0 | Fastest | 1.6 |
| 1 | Balanced | 0.8 |
| 2 | Slow | 0.4 |
| 3 | Slow | 0.28 |
| 4 | Slowest | 0.2 |