Kusto Query Language (KQL) - Top Operator

Basic Syntax:

The basic syntax for the top operator is as follows:

TableName
| top [count] by [Column]
    

• TableName: Specifies the name of the table you want to query.
• count: Specifies the number of top records you want to retrieve from the table.
• Column: Specifies the column based on which you want to determine the top records. Records will be selected based on the values in this column.

Common Use Cases:

1. Retrieving Top N Records:

The primary purpose of the top operator is to retrieve the top N records from a table, where N is the specified count. This helps you identify the highest or most relevant records in your data.

MyTable
| top 10 by SalesAmount
    

2. Top Records by Criteria:

You can use the by clause to determine the top records based on specific criteria or columns. This allows you to find the top records within different categories or groups.

MyTable
| top 5 by ProductCategory
    

3. Combining with Other Operators:

Combine the top operator with other operators like project and where to create more complex queries that select top records based on certain conditions or after data transformations.

MyTable
| where Year >= 2020
| top 3 by SalesAmount
    

4. Percentage of Top Records:

You can specify a percentage of top records to retrieve by using a percentage value instead of a fixed count. This allows you to dynamically select a portion of the top records.

MyTable
| top 20% by Score
    

The top operator is a useful tool for selecting and analyzing the top records in your data, helping you focus on the most relevant information for your analysis and reporting in Kusto Query Language.