take_any
The take_any aggregation function returns an arbitrary non-null value of Expression from each group. Results are non-deterministic.
Use this function with the summarize, eventstats, and timestats operators.
Syntax
take_any( Expression )Arguments
- Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.
Usage
Use take_any when you need a sample value from each group and event order does not matter.
When sort order matters, sort events with sort or order and use findfirst or findlast instead.
String literals are valid expressions and return the literal value.
Wildcard and multi-column forms, such as take_any(*), are not supported.
Column paths
You can reference nested fields with dot notation:
dataset=myDataset
| summarize take_any(my_field.my_value)Bracket notation treats the value as a string literal, not a nested field path:
dataset=myDataset
| summarize take_any(["my_field.my_value"])Examples
This example returns an arbitrary request method for each source port:
dataset="cribl_search_sample" dataSource=access*
| limit 1000
| summarize take_any(request_method) by srcport