Usage

The top operator is equivalent of aggregating by a field, sorting in descending order, and limiting the result set to the specified number of rows.

[n]	You must specify an integer. There is no implicit default.

Example

Example 1: Return the top ten values for a field and filter results with non-empty destination values.

Example 2: Returns the 10 most frequently occurring destination ports across OCSF events, ranked by highest count