top operator

Applies to: ✅ Microsoft FabricAzure Data ExplorerAzure MonitorMicrosoft Sentinel

Returns the first N records sorted by the specified column.

Syntax

T | top NumberOfRows by Expression [asc | desc] [nulls first | nulls last]

Learn more about syntax conventions.

Parameters

Name Type Required Description
T string ✔️ The tabular input to sort.
NumberOfRows int ✔️ The number of rows of T to return.
Expression string ✔️ The scalar expression by which to sort.
asc or desc string Controls whether the selection is from the "bottom" or "top" of the range. Default desc.
nulls first or nulls last string Controls whether null values appear at the "bottom" or "top" of the range. Default for asc is nulls first. Default for desc is nulls last.

Tip

top 5 by name is equivalent to the expression sort by name | take 5 both from semantic and performance perspectives.

Example

Show top three storms with most direct injuries.

StormEvents
| top 3 by InjuriesDirect

The below table shows only the relevant column. Run the query above to see more storm details for these events.

InjuriesDirect ...
519 ...
422 ...
200 ...
  • Use top-nested operator to produce hierarchical (nested) top results.