top-hitters operator

Learn how to use the top-hitters operator to return an approximation for the most popular distinct values in the input.

Returns an approximation for the most popular distinct values, or the values with the largest sum, in the input.

Syntax

T | top-hitters NumberOfValues of ValueExpression [ by SummingExpression ]

Parameters

NameTypeRequiredDescription
Tstring✔️The input tabular expression.
NumberOfValuesint, long, or real✔️The number of distinct values of ValueExpression.
ValueExpressionstring✔️An expression over the input table T whose distinct values are returned.
SummingExpressionstringIf specified, a numeric expression over the input table T whose sum per distinct value of ValueExpression establishes which values to emit. If not specified, the count of each distinct value of ValueExpression is used instead.

Examples

The examples in this section show how to use the syntax to help you get started.

Get top 2 events by totals

This example summarizes storm event data by calculating the total number of events for each event type. The query then selects the top two event types with the highest total number of events.

StormEvents
| summarize TotalEventId = sum(EventId) by EventType
| top 2 by TotalEventId desc

Output

EventTypeTotalEventId
Thunderstorm Wind562,509,013
Hail474,690,007

Get most frequent items

StormEvents
| top-hitters 5 of EventType

Output

EventTypeapproximate_count_EventType
Thunderstorm Wind13015
Hail12711
Flash Flood3688
Drought3616
Winter Weather3349

Get top hitters based on column value

This example shows how to find the States with the most Thunderstorm Wind events.

StormEvents
| where EventType == "Thunderstorm Wind"
| top-hitters 10 of State

Output

Stateapproximate_sum_State
TEXAS830
GEORGIA609
MICHIGAN602
IOWA585
PENNSYLVANIA549
ILLINOIS533
NEW YORK502
VIRGINIA482
KANSAS476
OHIO455