top-hitters operator

Syntax

T | top-hitters NumberOfValues of ValueExpression

T | top-hitters NumberOfValues of ValueExpression by SummingExpression

Arguments

• NumberOfValues: The number of distinct values of ValueExpression. Expressions of type int, long, and real are valid (rounded down).

• ValueExpression: An expression over the input table T whose distinct values are returned.

• SummingExpression: If specified, a numeric expression over the input table T whose sum per distinct value of ValueExpression establishes which values to emit. If not specified, the count of each distinct value of ValueExpression will be used instead.

Remarks

The first syntax (no SummingExpression) is conceptually equivalent to:

T | summarize C``=``count() by ValueExpression | top NumberOfValues by C desc

The second syntax (with SummingExpression) is conceptually equivalent to:

T | summarize S``=``sum(*SummingExpression*) by ValueExpression | top NumberOfValues by S desc

Examples

events
    | project src_ip, dst_ip, original_time
    | where original_time > ago(24h) 
    | where isnotempty(src_ip) and src_ip != '127.0.0.1'
    | summarize EventCount=count() by src_ip, dst_ip
    | top-hitters 5 of src_ip, dst_ip by EventCount