hll_if() (aggregation function)

Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Calculates the intermediate results of dcount in records for which the predicate evaluates to true.

Read about the underlying algorithm (HyperLogLog) and the estimation accuracy.

Note

This function is used in conjunction with the summarize operator.

Important

The results of hll(), hll_if(), and hll_merge() can be stored and later retrieved. For example, you may want to create a daily unique users summary, which can then be used to calculate weekly counts. However, the precise binary representation of these results may change over time. There's no guarantee that these functions will produce identical results for identical inputs, and therefore we don't advise relying on them.

Syntax

hll_if (expr, predicate [, accuracy])

Learn more about syntax conventions.

Parameters

Name	Type	Required	Description
expr	string	✔️	The expression used for the aggregation calculation.
predicate	string	✔️	The Expr used to filter records to add to the intermediate result of dcount.
accuracy	int		The value that controls the balance between speed and accuracy. If unspecified, the default value is 1. For supported values, see Estimation accuracy.

Returns

Returns the intermediate results of distinct count of Expr for which Predicate evaluates to true.

Tip

• You can use the aggregation function hll_merge to merge more than one hll intermediate result. Only works with hll output only.
• You can use dcount_hll, to calculate the distinct count from hll,hll_merge, or hll_if aggregation functions.

Examples

Run the query

StormEvents
| where State in ("IOWA", "KANSAS")
| summarize hll_flood = hll_if(Source, EventType == "Flood") by State
| project State, SourcesOfFloodEvents = dcount_hll(hll_flood)

State	SourcesOfFloodEvents
KANSAS	11
IOWA	7

Estimation accuracy

Accuracy	Speed	Error (%)
0	Fastest	1.6
1	Balanced	0.8
2	Slow	0.4
3	Slow	0.28
4	Slowest	0.2