top Search Operator

Use the top operator with the sort operator to reduce the number of sorted results returned.

tip

We recommend you instead use the topk operator so you can take advantage of its additional functionality.

Syntax

top <#> <field> [by <group_by_operator>]

Use the following query to list the top 5 source categories with errors, and get their count.

error | top 5 _sourcecategory

which produces results like:

example

You can use the following query to get the same results, but make the count explicit:

error | top 5 _sourcecategory by count

This query lists the top 10 source categories by message time, without an explicit count.

error | top 10 _sourcecategory by _messagetime

which produces results like:

example