From a61ac656550c05a33d245dac41d6231b90ee856b Mon Sep 17 00:00:00 2001 From: Hodayah Zargari Date: Wed, 27 May 2026 14:49:27 +0300 Subject: [PATCH] Retired content - Gain insights from your data by using KQL --- data-explorer/kusto/query/render-operator.md | 76 +++++++++---------- .../tutorials/use-aggregation-functions.md | 44 +++++------ 2 files changed, 59 insertions(+), 61 deletions(-) diff --git a/data-explorer/kusto/query/render-operator.md b/data-explorer/kusto/query/render-operator.md index 6cb21770ed..9c1a003203 100644 --- a/data-explorer/kusto/query/render-operator.md +++ b/data-explorer/kusto/query/render-operator.md @@ -3,16 +3,16 @@ title: render operator description: Learn how to use the render operator to instruct the user agent to render a visualization of the query results. ms.reviewer: alexans ms.topic: reference -ms.date: 08/11/2024 +ms.date: 05/27/2026 monikerRange: "microsoft-fabric || azure-data-explorer || azure-monitor || microsoft-sentinel" --- # render operator > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -Instructs the user agent to render a visualization of the query results. +The `render` operator instructs the user agent to visualize query results. It must be the last operator in your query and works only with queries that produce a single tabular data stream. -The render operator must be the last operator in the query, and can only be used with queries that produce a single tabular data stream result. The render operator doesn't modify data. It injects an annotation ("Visualization") into the result's extended properties. The annotation contains the information provided by the operator in the query. The interpretation of the visualization information is done by the user agent. Different agents, such as Kusto.Explorer or Azure Data Explorer web UI, may support different visualizations. +The operator doesn't modify data. Instead, it adds a "Visualization" annotation to the result's extended properties, containing the visualization instructions from your query. Different user agents, such as Kusto.Explorer or Azure Data Explorer web UI, interpret and support different visualizations based on this information. The data model of the render operator looks at the tabular data as if it has three kinds of columns: @@ -55,24 +55,24 @@ three kinds of columns: | *visualization* | Description | Illustration | |--|--|--| -| [`anomalychart`](visualization-anomalychart.md) | Similar to timechart, but highlights anomalies using [series_decompose_anomalies](series-decompose-anomalies-function.md) function. | :::image type="icon" source="media/renderoperator/anomaly-chart.png" border="false"::: | +| [`anomalychart`](visualization-anomalychart.md) | Similar to timechart, but highlights anomalies using the [series_decompose_anomalies](series-decompose-anomalies-function.md) function. | :::image type="icon" source="media/renderoperator/anomaly-chart.png" border="false"::: | | [`areachart`](visualization-areachart.md) | Area graph. | :::image type="icon" source="media/renderoperator/area-chart.png" border="false"::: | -| [`barchart`](visualization-barchart.md) | displayed as horizontal strips. | :::image type="icon" source="media/renderoperator/bar-chart.png" border="false"::: | -| [`card`](visualization-card.md) | First result record is treated as set of scalar values and shows as a card. | :::image type="icon" source="media/renderoperator/card.png" border="false"::: | +| [`barchart`](visualization-barchart.md) | Displayed as horizontal strips. | :::image type="icon" source="media/renderoperator/bar-chart.png" border="false"::: | +| [`card`](visualization-card.md) | The first result record is a set of scalar values and shows as a card. | :::image type="icon" source="media/renderoperator/card.png" border="false"::: | | [`columnchart`](visualization-columnchart.md) | Like `barchart` with vertical strips instead of horizontal strips. | :::image type="icon" source="media/renderoperator/column-chart.png" border="false"::: | -| [`ladderchart`](visualization-ladderchart.md) | Last two columns are the x-axis, other columns are y-axis. | :::image type="icon" source="media/renderoperator/ladder-chart.png" border="false"::: | +| [`ladderchart`](visualization-ladderchart.md) | The last two columns are the x-axis, and other columns are y-axis. | :::image type="icon" source="media/renderoperator/ladder-chart.png" border="false"::: | | [`linechart`](visualization-linechart.md) | Line graph. | :::image type="icon" source="media/renderoperator/line-chart.png" border="false"::: | -| [`piechart`](visualization-piechart.md) | First column is color-axis, second column is numeric. | :::image type="icon" source="media/renderoperator/pie-chart.png" border="false"::: | -| [`pivotchart`](visualization-pivotchart.md) | Displays a pivot table and chart. User can interactively select data, columns, rows and various chart types. | :::image type="icon" source="media/renderoperator/pivot-chart.png" border="false"::: | +| [`piechart`](visualization-piechart.md) | The first column is the color-axis, and the second column is numeric. | :::image type="icon" source="media/renderoperator/pie-chart.png" border="false"::: | +| [`pivotchart`](visualization-pivotchart.md) | Displays a pivot table and chart. You can interactively select data, columns, rows, and various chart types. | :::image type="icon" source="media/renderoperator/pivot-chart.png" border="false"::: | | [`scatterchart`](visualization-scatterchart.md) | Points graph. | :::image type="icon" source="media/renderoperator/scatter-chart.png" border="false"::: | | [`stackedareachart`](visualization-stackedareachart.md) | Stacked area graph. | :::image type="icon" source="media/renderoperator/stacked-area-chart.png" border="false"::: | | [`table`](visualization-table.md) | Default - results are shown as a table. | :::image type="icon" source="media/renderoperator/table-visualization.png" border="false"::: | -| [`timechart`](visualization-timechart.md) | Line graph. First column is x-axis, and must be datetime. Other (numeric) columns are y-axes. | :::image type="icon" source="media/renderoperator/visualization-timechart.png" border="false"::: | -| [`timepivot`](visualization-timepivot.md) | Interactive navigation over the events time-line (pivoting on time axis) | :::image type="icon" source="media/renderoperator/visualization-time-pivot.png" border="false"::: | +| [`timechart`](visualization-timechart.md) | Line graph. The first column is the x-axis, and must be datetime. Other (numeric) columns are y-axes. | :::image type="icon" source="media/renderoperator/visualization-timechart.png" border="false"::: | +| [`timepivot`](visualization-timepivot.md) | Interactive navigation over the events time-line (pivoting on time axis). | :::image type="icon" source="media/renderoperator/visualization-time-pivot.png" border="false"::: | | [`treemap`](visualization-treemap.md) | Displays hierarchical data as a set of nested rectangles. | :::image type="icon" source="media/renderoperator/tree-map.png" border="false"::: | > [!NOTE] -> The ladderchart, pivotchart, timepivot, and treemap visualizations can be used in Kusto.Explorer but are not available in the Azure Data Explorer web UI. +> The ladderchart, pivotchart, timepivot, and treemap visualizations can be used in Kusto.Explorer but aren't available in the Azure Data Explorer web UI. ::: moniker-end @@ -80,13 +80,13 @@ three kinds of columns: |*Visualization* |Description| Illustration | |--------------------|----------|---------| -| [`areachart`](visualization-areachart.md)| Area graph. First column is the x-axis and should be a numeric column. Other numeric columns are y-axes. | :::image type="icon" source="media/renderoperator/area-chart.png" border="false"::: | -| [`barchart`](visualization-barchart.md) | First column is the x-axis and can be text, datetime or numeric. Other columns are numeric, displayed as horizontal strips.| :::image type="icon" source="media/renderoperator/bar-chart.png" border="false"::: | +| [`areachart`](visualization-areachart.md)| Area graph. The first column is the x-axis and should be a numeric column. Other numeric columns are y-axes. | :::image type="icon" source="media/renderoperator/area-chart.png" border="false"::: | +| [`barchart`](visualization-barchart.md) | The first column is the x-axis and can be text, datetime, or numeric. Other columns are numeric and display as horizontal strips.| :::image type="icon" source="media/renderoperator/bar-chart.png" border="false"::: | | [`columnchart`](visualization-columnchart.md)| Like `barchart` with vertical strips instead of horizontal strips.| :::image type="icon" source="media/renderoperator/column-chart.png" border="false"::: | -| [`piechart`](visualization-piechart.md) | First column is color-axis, second column is numeric. | :::image type="icon" source="media/renderoperator/pie-chart.png" border="false"::: | -| [`scatterchart`](visualization-scatterchart.md) | Points graph. First column is the x-axis and should be a numeric column. Other numeric columns are y-axes. | :::image type="icon" source="media/renderoperator/scatter-chart.png" border="false"::: | +| [`piechart`](visualization-piechart.md) | The first column is the color-axis, and the second column is numeric. | :::image type="icon" source="media/renderoperator/pie-chart.png" border="false"::: | +| [`scatterchart`](visualization-scatterchart.md) | Points graph. The first column is the x-axis and should be a numeric column. Other numeric columns are y-axes. | :::image type="icon" source="media/renderoperator/scatter-chart.png" border="false"::: | | [`table`](visualization-table.md) | Default - results are shown as a table.| :::image type="icon" source="media/renderoperator/table-visualization.png" border="false"::: | -| [`timechart`](visualization-timechart.md) | Line graph. First column is x-axis, and should be datetime. Other (numeric) columns are y-axes. There's one string column whose values are used to "group" the numeric columns and create different lines in the chart (further string columns are ignored).| :::image type="icon" source="media/renderoperator/visualization-timechart.png" border="false"::: | +| [`timechart`](visualization-timechart.md) | Line graph. The first column is the x-axis, and should be datetime. Other (numeric) columns are y-axes. There's one string column whose values are used to "group" the numeric columns and create different lines in the chart (further string columns are ignored).| :::image type="icon" source="media/renderoperator/visualization-timechart.png" border="false"::: | ::: moniker-end @@ -94,17 +94,17 @@ three kinds of columns: | *visualization*| Description| Illustration | |-----------|------------|---------| -| [`anomalychart`](visualization-anomalychart.md)| Similar to timechart, but highlights anomalies using [series_decompose_anomalies](series-decompose-anomalies-function.md) function. | :::image type="icon" source="media/renderoperator/anomaly-chart.png" border="false"::: | +| [`anomalychart`](visualization-anomalychart.md)| Similar to timechart, but highlights anomalies using the [series_decompose_anomalies](series-decompose-anomalies-function.md) function. | :::image type="icon" source="media/renderoperator/anomaly-chart.png" border="false"::: | | [`areachart`](visualization-areachart.md) | Area graph.| :::image type="icon" source="media/renderoperator/area-chart.png" border="false"::: | -| [`barchart`](visualization-barchart.md) | displayed as horizontal strips.| :::image type="icon" source="media/renderoperator/bar-chart.png" border="false"::: | -| [`card`](visualization-card.md) | First result record is treated as set of scalar values and shows as a card.| :::image type="icon" source="media/renderoperator/card.png" border="false"::: +| [`barchart`](visualization-barchart.md) | Displayed as horizontal strips.| :::image type="icon" source="media/renderoperator/bar-chart.png" border="false"::: | +| [`card`](visualization-card.md) | The first result record is a set of scalar values and shows as a card.| :::image type="icon" source="media/renderoperator/card.png" border="false"::: | [`columnchart`](visualization-columnchart.md) | Like `barchart` with vertical strips instead of horizontal strips.| :::image type="icon" source="media/renderoperator/column-chart.png" border="false"::: | | [`linechart`](visualization-linechart.md) | Line graph. | :::image type="icon" source="media/renderoperator/line-chart.png" border="false"::: | -| [`piechart`](visualization-piechart.md) | First column is color-axis, second column is numeric.| :::image type="icon" source="media/renderoperator/pie-chart.png" border="false"::: | +| [`piechart`](visualization-piechart.md) | The first column is the color-axis, and the second column is numeric.| :::image type="icon" source="media/renderoperator/pie-chart.png" border="false"::: | | [`scatterchart`](visualization-scatterchart.md) | Points graph.| :::image type="icon" source="media/renderoperator/scatter-chart.png" border="false"::: | | [`stackedareachart`](visualization-stackedareachart.md) | Stacked area graph.| :::image type="icon" source="media/renderoperator/stacked-area-chart.png" border="false"::: | | [`table`](visualization-table.md) | Default - results are shown as a table.| :::image type="icon" source="media/renderoperator/table-visualization.png" border="false"::: | -| [`timechart`](visualization-timechart.md) | Line graph. First column is x-axis, and must be datetime. Other (numeric) columns are y-axes. | :::image type="icon" source="media/renderoperator/visualization-timechart.png" border="false"::: | +| [`timechart`](visualization-timechart.md) | Line graph. The first column is the x-axis, and must be datetime. Other (numeric) columns are y-axes. | :::image type="icon" source="media/renderoperator/visualization-timechart.png" border="false"::: | ::: moniker-end @@ -131,7 +131,7 @@ three kinds of columns: |`ycolumns` |Comma-delimited list of columns that consist of the values provided per value of the x column.| |`ysplit` |How to split the visualization into multiple y-axis values. For more information, see [`y-split` property](#ysplit-property). | |`ytitle` |The title of the y-axis (of type `string`). | -|`anomalycolumns`|Property relevant only for `anomalychart`. Comma-delimited list of columns, which will be considered as anomaly series and displayed as points on the chart| +|`anomalycolumns`|Property relevant only for `anomalychart`. Comma-delimited list of columns, which are considered as anomaly series and displayed as points on the chart| ::: moniker-end @@ -147,8 +147,8 @@ three kinds of columns: #### `kind` property -This visualization can be further elaborated by providing the `kind` property. -The supported values of this property are: +You can further elaborate this visualization by providing the `kind` property. +The supported values for this property are: |*Visualization*|`kind` |Description | |---------------|-------------------|-----------------------------------| @@ -181,18 +181,18 @@ Some visualizations support splitting into multiple y-axis values: ## How to render continuous data -Several visualizations are used for rendering sequences of values, for example, `linechart`, `timechart`, and `areachart`. -These visualizations have the following conceptual model: +To render sequences of values, use several visualizations, such as `linechart`, `timechart`, and `areachart`. +These visualizations follow the conceptual model: -* One column in the table represents the x-axis of the data. This column can be explicitly defined using the - `xcolumn` property. If not defined, the user agent picks the first column that is appropriate for the visualization. - * For example: in the `timechart` visualization, the user agent uses the first `datetime` column. - * If this column is of type `dynamic` and it holds an array, the individual values in the array will be treated as the values of the x-axis. +* One column in the table represents the x-axis of the data. You can explicitly define this column by using the + `xcolumn` property. If you don't define it, the user agent picks the first column that works for the visualization. + * For example, in the `timechart` visualization, the user agent uses the first `datetime` column. + * If this column is of type `dynamic` and it holds an array, the individual values in the array are treated as the values of the x-axis. * One or more columns in the table represent one or more measures that vary by the x-axis. - These columns can be explicitly defined using the `ycolumns` property. If not defined, the user agent picks all columns that are appropriate for the visualization. - * For example: in the `timechart` visualization, the user agent uses all columns with a numeric value that haven't been specified otherwise. + You can explicitly define these columns by using the `ycolumns` property. If you don't define it, the user agent picks all columns that work for the visualization. + * For example, in the `timechart` visualization, the user agent uses all columns with a numeric value that you didn't specify otherwise. * If the x-axis is an array, the values of each y-axis should also be an array of a similar length, with each y-axis occurring in a single column. -* Zero or more columns in the table represent a unique set of dimensions that group together the measures. These columns can be specified by the `series` property, or the user agent will pick them automatically from the columns that are otherwise unspecified. +* Zero or more columns in the table represent a unique set of dimensions that group together the measures. You can specify these columns by using the `series` property, or the user agent picks them automatically from the columns that are otherwise unspecified. ::: moniker-end ::: moniker range="microsoft-fabric || azure-data-explorer" @@ -213,11 +213,9 @@ These visualizations have the following conceptual model: three kinds of columns: > > * The x axis column (indicated by the `xcolumn` property). -> * The series columns (any number of columns indicated by the `series` property.) -> * The y axis columns (any number of columns indicated by the `ycolumns` - property). - For each record, the series has as many measurements ("points" in the chart) - as there are y-axis columns. +> * The series columns (any number of columns indicated by the `series` property). +> * The y axis columns (any number of columns indicated by the `ycolumns` property). +> For each record, the series has as many measurements ("points" in the chart) as there are y-axis columns. ## Example diff --git a/data-explorer/kusto/query/tutorials/use-aggregation-functions.md b/data-explorer/kusto/query/tutorials/use-aggregation-functions.md index 13934bd89e..205f90c29b 100644 --- a/data-explorer/kusto/query/tutorials/use-aggregation-functions.md +++ b/data-explorer/kusto/query/tutorials/use-aggregation-functions.md @@ -2,16 +2,16 @@ title: 'Tutorial: Use aggregation functions in Kusto Query Language' description: Learn how to use aggregation functions in Kusto Query Language (KQL) to summarize and analyze data effectively in this step-by-step tutorial. ms.topic: tutorial -ms.date: 09/15/2025 +ms.date: 05/27/2026 --- # Tutorial: Use aggregation functions > [!INCLUDE [applies](../../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../../includes/applies-to-version/sentinel.md)] -[Aggregation functions](../aggregation-functions.md) allow you to group and combine data from multiple rows into a summary value. The summary value depends on the chosen function, for example a count, maximum, or average value. +[Aggregation functions](../aggregation-functions.md) group and combine data from multiple rows into a summary value. The summary value depends on the chosen function, such as a count, maximum, or average value. -In this tutorial, you'll learn how to: +In this tutorial, you learn how to: > [!div class="checklist"] > @@ -36,7 +36,7 @@ This tutorial builds on the foundation from the first tutorial, [Learn common op ## Prerequisites -To run the following queries, you need a query environment with access to the sample data. You can use one of the following: +To run the following queries, you need a query environment with access to the sample data. Use one of the following options: :::moniker range="azure-data-explorer" * A Microsoft account or Microsoft Entra user identity to sign in to the [help cluster](https://dataexplorer.azure.com/clusters/help) ::: moniker-end @@ -48,7 +48,7 @@ To run the following queries, you need a query environment with access to the sa ## Use the summarize operator -The [summarize](../summarize-operator.md) operator is essential to performing aggregations over your data. The `summarize` operator groups together rows based on the `by` clause and then uses the provided aggregation function to combine each group in a single row. +The [summarize](../summarize-operator.md) operator is essential for performing aggregations over your data. The `summarize` operator groups together rows based on the `by` clause and then uses the provided aggregation function to combine each group into a single row. Find the number of events by state using `summarize` with the [count](../count-aggregation-function.md) aggregation function. @@ -75,9 +75,9 @@ StormEvents ## Visualize query results -Visualizing query results in a chart or graph can help you identify patterns, trends, and outliers in your data. You can do this with the [render](../render-operator.md) operator. +Visualizing query results in a chart or graph can help you identify patterns, trends, and outliers in your data. You can create these visualizations by using the [render](../render-operator.md) operator. -Throughout the tutorial, you'll see examples of how to use `render` to display your results. For now, let's use `render` to see the results from the previous query in a bar chart. +Throughout the tutorial, you see examples of how to use `render` to display your results. Some available chart types include bar charts, line charts, pie charts, and scatter charts. For now, use `render` to see the results from the previous query in a bar chart. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -94,9 +94,9 @@ StormEvents ## Conditionally count rows -When analyzing your data, use [countif()](../countif-aggregation-function.md) to count rows based on a specific condition to understand how many rows meet the given criteria. +When analyzing your data, use [countif()](../countif-aggregation-function.md) to count rows based on a specific condition. This function helps you understand how many rows meet the given criteria. -The following query uses `countif()` to count of storms that caused damage. The query then uses the `top` operator to filter the results and display the states with the highest amount of crop damage caused by storms. +The following query uses `countif()` to count storms that caused damage. The query then uses the `top` operator to filter the results and display the states with the highest amount of crop damage caused by storms. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -121,7 +121,7 @@ StormEvents ## Group data into bins -To aggregate by numeric or time values, you'll first want to group the data into bins using the [bin()](../bin-function.md) function. Using `bin()` can help you understand how values are distributed within a certain range and make comparisons between different periods. +To aggregate data by numeric or time values, first group the data into bins by using the [bin()](../bin-function.md) function. Using `bin()` helps you understand how values are distributed within a certain range and makes it easier to compare different periods. The following query counts the number of storms that caused crop damage for each week in 2007. The `7d` argument represents a week, as the function requires a valid [timespan](../scalar-data-types/timespan.md) value. @@ -162,9 +162,9 @@ Add `| render timechart` to the end of the query to visualize the results. ## Calculate the min, max, avg, and sum -To learn more about types of storms that cause crop damage, calculate the [min()](../min-aggregation-function.md), [max()](../max-aggregation-function.md), and [avg()](../avg-aggregation-function.md) crop damage for each event type, and then sort the result by the average damage. +To learn more about the types of storms that cause crop damage, calculate the [min()](../min-aggregation-function.md), [max()](../max-aggregation-function.md), and [avg()](../avg-aggregation-function.md) crop damage for each event type. Then, sort the result by the average damage. -Note that you can use multiple aggregation functions in a single `summarize` operator to produce several computed columns. +You can use multiple aggregation functions in a single `summarize` operator to produce several computed columns. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -193,7 +193,7 @@ StormEvents |Thunderstorm Wind|22000000|100|920328.36538461538| |...|...|...|...| -The results of the previous query indicate that Frost/Freeze events resulted in the most crop damage on average. However, the [bin() query](#group-data-into-bins) showed that events with crop damage mostly took place in the summer months. +The results of the previous query indicate that Frost/Freeze events result in the most crop damage on average. However, the [bin() query](#group-data-into-bins) shows that events with crop damage mostly take place in the summer months. Use [sum()](../sum-aggregation-function.md) to check the total number of damaged crops instead of the amount of events that caused some damage, as done with `count()` in the previous [bin() query](#group-data-into-bins). @@ -215,11 +215,11 @@ StormEvents Now you can see a peak in crop damage in January, which probably was due to Frost/Freeze. > [!TIP] -> Use [minif()](../minif-aggregation-function.md), [maxif()](../maxif-aggregation-function.md), [avgif()](../avgif-aggregation-function.md), and [sumif()](../sumif-aggregation-function.md) to perform conditional aggregations, like we did when in the [conditionally count rows](#conditionally-count-rows) section. +> Use [minif()](../minif-aggregation-function.md), [maxif()](../maxif-aggregation-function.md), [avgif()](../avgif-aggregation-function.md), and [sumif()](../sumif-aggregation-function.md) to perform conditional aggregations, like you did in the [conditionally count rows](#conditionally-count-rows) section. ## Calculate percentages -Calculating percentages can help you understand the distribution and proportion of different values within your data. This section covers two common methods for calculating percentages with the Kusto Query Language (KQL). +Calculating percentages can help you understand the distribution and proportion of different values within your data. This section covers two common methods for calculating percentages by using the Kusto Query Language (KQL). ### Calculate percentage based on two columns @@ -257,13 +257,13 @@ StormEvents |...|...|...|...| > [!NOTE] -> When calculating percentages, convert at least one of the integer values in the division with [todouble() or toreal()](../toreal-function.md). This will ensure that you don't get truncated results due to integer division. For more information, see [Type rules for arithmetic operations](../numerical-operators.md#type-rules-for-arithmetic-operations). +> When calculating percentages, convert at least one of the integer values in the division with [todouble() or toreal()](../toreal-function.md). This conversion ensures that you don't get truncated results due to integer division. For more information, see [Type rules for arithmetic operations](../numerical-operators.md#type-rules-for-arithmetic-operations). ### Calculate percentage based on table size -To compare the number of storms by event type to the total number of storms in the database, first save the total number of storms in the database as a variable. [Let statements](../let-statement.md) are used to define variables within a query. +To compare the number of storms by event type to the total number of storms in the database, first save the total number of storms in the database as a variable. Use [Let statements](../let-statement.md) to define variables within a query. -Since [tabular expression statements](../tabular-expression-statements.md) return tabular results, use the [toscalar()](../toscalar-function.md) function to convert the tabular result of the `count()` function to a scalar value. Then, the numeric value can be used in the percentage calculation. +Since [tabular expression statements](../tabular-expression-statements.md) return tabular results, use the [toscalar()](../toscalar-function.md) function to convert the tabular result of the `count()` function to a scalar value. Then, use the numeric value in the percentage calculation. :::moniker range="azure-data-explorer" > [!div class="nextstepaction"] @@ -383,17 +383,17 @@ StormEvents ## Perform aggregations over a sliding window -The following example shows how to summarize columns using a sliding window. +The following example shows how to summarize columns by using a sliding window. -The query calculates the minimum, maximum, and average property damage of tornados, floods, and wildfires using a sliding window of seven days. Each record in the result set aggregates the preceding seven days, and the results contain a record per day in the analysis period. +The query calculates the minimum, maximum, and average property damage of tornados, floods, and wildfires by using a sliding window of seven days. Each record in the result set aggregates the preceding seven days, and the results contain a record per day in the analysis period. Here's a step-by-step explanation of the query: 1. Bin each record to a single day relative to `windowStart`. 1. Add seven days to the bin value to set the end of the range for each record. If the value is out of the range of `windowStart` and `windowEnd`, adjust the value accordingly. 1. Create an array of seven days for each record, starting from the current day of the record. -1. Expand the array from step 3 with [mv-expand](../mv-expand-operator.md) in order to duplicate each record to seven records with one-day intervals between them. -1. Perform the aggregations for each day. Due to step 4, this step actually summarizes the previous seven days. +1. Expand the array from step 3 by using [mv-expand](../mv-expand-operator.md) to duplicate each record to seven records with one-day intervals between them. +1. Perform the aggregations for each day. Because of step 4, this step actually summarizes the previous seven days. 1. Exclude the first seven days from the final result because there's no seven-day lookback period for them. :::moniker range="azure-data-explorer"