top-hitters operator

Learn how to use the top-hitters operator to return an approximation for the most popular distinct values in the input.

Returns an approximation for the most popular distinct values, or the values with the largest sum, in the input.

Syntax

T | top-hitters NumberOfValues of ValueExpression [ by SummingExpression ]

Name	Type	Required	Description
T	`string`	✔️	The input tabular expression.
NumberOfValues	int, long, or real	✔️	The number of distinct values of ValueExpression.
ValueExpression	`string`	✔️	An expression over the input table T whose distinct values are returned.
SummingExpression	`string`		If specified, a numeric expression over the input table T whose sum per distinct value of ValueExpression establishes which values to emit. If not specified, the count of each distinct value of ValueExpression is used instead.

The first syntax (no SummingExpression) is conceptually equivalent to:

T | summarize C``=``count() by ValueExpression | top NumberOfValues by C desc

The second syntax (with SummingExpression) is conceptually equivalent to:

T | summarize S``=``sum(*SummingExpression*) by ValueExpression | top NumberOfValues by S desc

StormEvents
| top-hitters 5 of EventType

Output

EventType	approximate_count_EventType
Thunderstorm Wind	13015
Hail	12711
Flash Flood	3688
Drought	3616
Winter Weather	3349

The next example shows how to find the States with the most “Thunderstorm Wind” events.

StormEvents
| where EventType == "Thunderstorm Wind"
| top-hitters 10 of State

Output

Was this page helpful?

Sorry to hear that. Please tell us how we can improve.