top operator

Syntax

T | top NumberOfRows by Expression [asc | desc] [nulls first | nulls last]

Arguments

• NumberOfRows: The number of rows of T to return. You can specify any numeric expression.
• Expression: A scalar expression by which to sort. The type of the values must be numeric, date, time or string.
• asc or desc (the default) may appear to control whether selection is actually from the "bottom" or "top" of the range.
• nulls first (the default for asc order) or nulls last (the default for desc order) may appear to control whether null values will be at the beginning or the end of the range.

Example

events
    | project EventName=name, original_time
    | where original_time > ago(24h)
    | summarize EventCount=count() by EventName
    | top 6 by EventCount