Edit

Share via

hll_if() (aggregation function)

  • Article

Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Calculates the intermediate results of dcount in records for which the predicate evaluates to true.

Read about the underlying algorithm (HyperLogLog) and the estimation accuracy.

Note

This function is used in conjunction with the summarize operator.

Syntax

hll_if (expr, predicate [, accuracy])

Learn more about syntax conventions.

Parameters

Name Type Required Description
expr string ✔️ The expression used for the aggregation calculation.
predicate string ✔️ The Expr used to filter records to add to the intermediate result of dcount.
accuracy int The value that controls the balance between speed and accuracy. If unspecified, the default value is 1. For supported values, see Estimation accuracy.

Returns

Returns the intermediate results of distinct count of Expr for which Predicate evaluates to true.

Note

  • The results of hll(), hll_if(), and hll_merge() can be stored and later retrieved. For example, you might want to create a daily unique user summary, which can then be used to calculate weekly counts. However, the precise binary representation of these results might change over time. There's no guarantee that these functions produce identical results for identical inputs, and therefore we don't advise relying on them.
  • Use the hll_merge function to merge more than one hll intermediate result. Only works with hll output.
  • Use dcount_hll, to calculate the distinct count from hll,hll_merge, or hll_if aggregation functions.

Examples

The following query results in the number of unique flood event sources in Iowa and Kansas. It uses the hll_if() function to show only flood events.

StormEvents
| where State in ("IOWA", "KANSAS")
| summarize hll_flood = hll_if(Source, EventType == "Flood") by State
| project State, SourcesOfFloodEvents = dcount_hll(hll_flood)

Output

State SourcesOfFloodEvents
KANSAS 11
IOWA 7

Estimation accuracy

Accuracy Speed Error (%)
0 Fastest 1.6
1 Balanced 0.8
2 Slow 0.4
3 Slow 0.28
4 Slowest 0.2

Related content