max_by

Description

Returns the value of an expression associated with the maximum value of a given sort key.

• Both sortKey and expression must be comparable types (string, bool, number, interval, timestamp, regexp, or enum).
• Useful for retrieving details from the row that has the maximum value of another field.

Syntax

max_by(sortKey: T, expression: U): U

Arguments

Example

Use case: Retrieve details of the latest event per user

Suppose you want to know the last activity performed by each user. You can use max to compute the latest timestamp and max_by to extract the associated details.

Example data

{ "username": "chris", "path": "/home", "latency": 320, "ts": 1728919749261000000 },
{ "username": "chris", "path": "/checkout", "latency": 5000, "ts": 1728919759261000000 }

Example query

groupby username aggregate max(ts) as ts, max_by(ts, path) as path

Example output