facet operator

Applies to: ✅ Microsoft Fabric ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Returns a set of tables, one for each column specified in the facet clause. Each table contains the list of values taken by its column. An additional table can be created by using the with clause. Facet result tables can't be renamed or referenced by any additional operators.

Syntax

T | facet by ColumnName [, ColumnName2, ...] [with ( filterPipe )]

Learn more about syntax conventions.

Parameters

Name	Type	Required	Description
ColumnName	string	✔️	The column name, or list of column names, to be summarized.
filterPipe	string		A query expression applied to the input table.

Returns

Multiple tables: one for the with clause, and one for each column.

Examples

The following example shows how to use the facet operator to return a table for each specified column.

Run the query

StormEvents
| where State startswith "A" and EventType has "Heavy"
| facet by State, EventType
    with 
    (
    where StartTime between(datetime(2007-01-04) .. 7d) 
    | project State, StartTime, Source, EpisodeId, EventType
    | take 5
    )

The following is the table generated by the with clause.

State	StartTime	Source	EpisodeId	EventType
ALASKA	2007-01-04 12:00:00.0000000	COOP Observer	2192	Heavy Snow
ALASKA	2007-01-04 15:00:00.0000000	Trained Spotter	2192	Heavy Snow
ALASKA	2007-01-04 15:00:00.0000000	Trained Spotter	2192	Heavy Snow
ALASKA	2007-01-04 15:00:00.0000000	Trained Spotter	2192	Heavy Snow
ALASKA	2007-01-06 18:00:00.0000000	COOP Observer	2193	Heavy Snow

The following table is the State facet output table.

State	count_State
ALABAMA	19
ARIZONA	33
ARKANSAS	1
AMERICAN SAMOA	1
ALASKA	58

The following table is the EventType facet output table.

EventType	count_EventType
Heavy Rain	34
Heavy Snow	78