Kusto select distinct on one column only

user_8586863 0
Viewed 138

Example Query -

traces | project message, timestamp

This outputs something like this -

message  |   timestamp
------------------------------
    A      2022-07-09 00:00:00
    B      2022-07-11 01:00:00
    A      2022-07-11 02:00:00

I want a query that gives this as output -

message  |   timestamp
------------------------------
    A      2022-07-09 00:00:00
    B      2022-07-11 01:00:00
kql azure-data-explorer
1 Answers

you could use the min() aggregation function if you only have 2 fields of interest (message, timestamp), or the arg_min() aggregation function otherwise.

e.g.

traces | summarize min(timestamp) by message

traces | summarize arg_min(timestamp, *) by message
user_78618070
Related