dcount, dcountif

The dcount() aggregation function is primarily useful for estimating the cardinality of huge sets

Estimation accuracy

The dcount() aggregate function uses a variant of the HyperLogLog (HLL) algorithm, which does a stochastic estimation of set cardinality. The algorithm provides a "knob" that can be used to balance accuracy and execution time per memory size:

AccuracyError (%)Entry count

0

1.6

212

1

0.8

214

2

0.4

216

3

0.28

217

4

0.2

218

dcount, dcountifIntuneDevices
| where TimeGenerated > ago (30d)
        and isnotempty(OS)
| summarize Count = dcount(SerialNumber, 4)

dcountif

IntuneDevices
| where TimeGenerated > ago (30d)
        and isnotempty(OS)
| summarize Count = dcountif(SerialNumber, OS != 'Windows')
Previouscount, countifNexttake_any

Last updated