summarize

Groups rows by one or more key columns and computes aggregations over each group.

Spec

... | summarize <aggregation> [, ...] [by <group_column> [, ...]]

Parameters

aggregation   - An aggregate function call, optionally aliased (e.g. total = count()).
group_column  - A column or expression to group by.

Return Value

One row per unique combination of group columns. Output contains the group columns
and the aggregation result columns.

Example

datatable(Service:string, Latency:int64)
[
    "web", 10,
    "web", 20,
    "api", 5,
    "api", 15
]
| summarize avg(Latency), count() by Service

Summarize without grouping returns a single row:

range val from 1 to 5 step 1
| summarize sum(val), count()

Execution contracts

• An ungrouped summarize over empty input returns no rows.
• Null keys form one group. All NaN values of the same key type also form one group.
• Group output order is unspecified. Aggregates documented as order-sensitive use input arrival order.
• String grouping and ordering compare case-sensitive ordinal UTF-8 bytes.
• Integer aggregate overflow fails the query. Arithmetic aggregates propagate NaN.
• Min, max, and percentile order NaN before finite values.
• Parallel floating-point state merges may use any mathematically valid merge order.
• Results may be emitted after a final spill partition is complete. A later terminal error invalidates the complete streamed result.

Indexed-file optimization

Indexed-file V4 row groups persist checksummed row count, null count, sum, minimum, and maximum statistics. count, sum, agg_avg, agg_min, and agg_max can be answered from those statistics when their inputs are direct columns. Grouped metadata execution additionally requires every row group to be provably single-valued for each key; direct keys and constant-width bin expressions support that proof. A row-level predicate, an older file, unavailable statistics, or any failed proof falls back to the normal row scan without changing query results.