facet operator

Learn how to use the facet operator to return a table for each specified column.

Returns a set of tables, one for each column specified in the facet clause. Each table contains the list of values taken by its column. An additional table can be created by using the with clause. Facet result tables can’t be renamed or referenced by any additional operators.

Syntax

T | facet by ColumnName [, ColumnName2, …] [with ( filterPipe )]

Parameters

Name	Type	Required	Description
ColumnName	`string`	✔️	The column name, or list of column names, to be summarized.
filterPipe	`string`		A query expression applied to the input table.

Returns

Multiple tables: one for the with clause, and one for each column.

Example

StormEvents
| where State startswith "A" and EventType has "Heavy"
| facet by State, EventType
    with 
    (
    where StartTime between(datetime(2007-01-04) .. 7d) 
    | project State, StartTime, Source, EpisodeId, EventType
    | take 5
    )

The following is the table generated by the with clause.

State	StartTime	Source	EpisodeId	EventType
ALASKA	2007-01-04 12:00:00.0000000	COOP Observer	2192	Heavy Snow
ALASKA	2007-01-04 15:00:00.0000000	Trained Spotter	2192	Heavy Snow
ALASKA	2007-01-04 15:00:00.0000000	Trained Spotter	2192	Heavy Snow
ALASKA	2007-01-04 15:00:00.0000000	Trained Spotter	2192	Heavy Snow
ALASKA	2007-01-06 18:00:00.0000000	COOP Observer	2193	Heavy Snow

The following table is the State facet output table.

State	count_State
ALABAMA	19
ARIZONA	33
ARKANSAS	1
AMERICAN SAMOA	1
ALASKA	58

The following table is the EventType facet output table.

EventType	count_EventType
Heavy Rain	34
Heavy Snow	78

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.