take_anyif ​

The take_anyif aggregation function returns an arbitrary non-null value of Expression from rows where Predicate evaluates to true. Results are non-deterministic.

Use this function with the summarize, eventstats, and timestats operators.

Syntax ​

take_anyif( Expression, Predicate )

Arguments ​

• Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.
• Predicate: Expression that will be used to filter rows.

Usage ​

Use take_anyif when you need a sample value from each group for rows that match a condition and event order does not matter.

When sort order matters, sort events with sort or order and use findfirstif or findlastif instead.

If Predicate is null, it evaluates to false.

Wildcard and multi-column forms are not supported.

Example ​

This example returns an arbitrary status code of 400 or higher for each host:

dataset=myDataset
| summarize take_anyif(status, status >= 400) by host