make_set_if() (aggregation function)

  • Article
  • 09/30/2024

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Creates a dynamic array of the set of distinct values that expr takes in records for which predicate evaluates to true.

Null values are ignored and don't factor into the calculation.

Note

This function is used in conjunction with the summarize operator.

Syntax

make_set_if(expr, predicate [, maxSize])

Learn more about syntax conventions.

Parameters

Name Type Required Description
expr string ✔️ The expression used for the aggregation calculation.
predicate string ✔️ A predicate that has to evaluate to true in order for expr to be added to the result.
maxSize int The maximum number of elements returned. The default and max value is 1048576.

Returns

Returns a dynamic array of the set of distinct values that expr takes in records for which predicate evaluates to true. The array's sort order is undefined.

Tip

To only count the distinct values, use dcountif().

Related content

make_set function, which does the same, without predicate expression.

Example

The following example shows a list of names with more than 4 letters.

Run the query

let T = datatable(name:string, day_of_birth:long)
[
   "John", 9,
   "Paul", 18,
   "George", 25,
   "Ringo", 7
];
T
| summarize make_set_if(name, strlen(name) > 4)

Output

set_name
["George", "Ringo"]