How can i do a "GROUP BY WITH ROLLUP" in Kusto?

Question

In T-SQL, when grouping results, you can also get a running total row when specifying "WITH ROLLUP".

How can i achieve this in Kusto? So, consider the following query:

customEvents | summarize counter = count() by name

The query above gives me a list of event names, and how often they occurred. This is what i need, but i also want a row with the running total (the count of all events).

It feels like there should be an easy way to achieve this, but i havent found anything in the docs ...

Answer 1

You can write 2 queries, the first query is used to count the number of each events, the second query is used to count the numbers of all the events. Then use the union operator to join them.

The query like below:

customEvents 
| count 
| extend name = "total",counter=Count
| project name,counter
| union
(customEvents 
| summarize counter = count() by name)

Test result is as below: