Usage

Typically, use the limit operator together with the sort operator to filter results as you like—for example, to filter for the "top 10" results.

Examples

Example 1: Filters to allowed or accepted connections with known inbound byte counts, selects core network flow fields, and returns the top 100 heaviest inbound transfers.

| where action in ('allow', 'accept') and bytes_in is not null
| fields action, src, src_port, dest, dest_port, bytes_in, bytes_out
| sort bytes_in desc
| limit 100 

Example 2: Counts events per source hostname for non-empty products, sorts by highest count, and caps the output at 100 rows.

ocsf | where metadata.product.name!='' | aggr count as src_cnt by src_endpoint.hostname | sort src_cnt desc | limit 100