max() (aggregation function)

Applies to: ✅ Azure Data ExplorerAzure MonitorMicrosoft Sentinel

Finds the maximum value the expression in the group.

Note

This function is used in conjunction with the summarize operator.

Syntax

max(expr)

Learn more about syntax conventions.

Parameters

Name Type Required Description
expr string ✔️ The expression used for the aggregation calculation.

Returns

Returns the maximum value of expr across the group.

Tip

This gives you the max on its own. If you want to see other columns in addition to the max, use arg_max.

Example

This example returns the last record in a table.

StormEvents
| summarize LatestEvent=max(StartTime)

Output

LatestEvent
2007-12-31T23:53:00Z