sample operator

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Returns up to the specified number of random rows from the input table.

Syntax

T | sample NumberOfRows

Learn more about syntax conventions.

Parameters

Examples

The example in this section shows how to use the syntax to help you get started.

Generate a sample

This query creates a range of numbers, samples one value, and then duplicates that sample.

let _data = range x from 1 to 100 step 1;
let _sample = _data | sample 1;
union (_sample), (_sample)

Output

To ensure that in example above _sample is calculated once, one can use materialize() function:

let _data = range x from 1 to 100 step 1;
let _sample = materialize(_data | sample 1);
union (_sample), (_sample)

Output

Generate a sample of a certain percentage of data

To sample a certain percentage of your data (rather than a specified number of rows), you can use

StormEvents | where rand() < 0.1

Output

The table contains the first few rows of the output. Run the query to view the full result.

Generate a sample of keys

To sample keys rather than rows (for example - sample 10 Ids and get all rows for these Ids), you can use sample-distinct in combination with the in operator.

let sampleEpisodes = StormEvents | sample-distinct 10 of EpisodeId;
StormEvents
| where EpisodeId in (sampleEpisodes)

Output

The table contains the first few rows of the output. Run the query to view the full result.