topk
Returns the `K` keys with the largest summed weight within each group, as a dynamic array of property bags ordered by weight descending.
Each bag carries key, value (the summed weight) and guaranteed. Use
mv-expand to recover one row per key:
| summarize top5 = topk(pod, rate, 5) by bin(timestamp, 1m)
| mv-expand top5Rows may arrive already reduced to one per key, or raw and needing accumulation — summing per key covers both, since with one row per key the sum is that row's value.
The result is exact while a group holds no more distinct keys than the
internal reservoir, which is far larger than K. Beyond that it is an
estimate: guaranteed is true for a key provably heavier than anything
discarded, and the query warns when a returned key is not. Weights must be
positive — Space-Saving's eviction assumes non-negative values — and rows
with a negative, zero, or non-finite weight are reported as a warning rather
than counted.
Syntax
topk(key, weight)Parameters
Prop
Type
Returns: dynamic
Syntax
topk(key, weight, k)Parameters
Prop
Type
Returns: dynamic
Syntax
topk(key, weight, k)Parameters
Prop
Type
Returns: dynamic
Examples
Example 1
datatable(warrior:string, region:string, voyages:long)[
"Ragnar", "Kattegat", 42,
"Bjorn", "Kattegat", 31,
"Ivar", "Kattegat", 35,
"Harald", "Vestfold", 25,
"Floki", "Vestfold", 12
]
| summarize top2 = topk(warrior, voyages, 2) by region| region (string) | top2 (dynamic) |
|---|---|
| Kattegat | [{"guaranteed":true,"key":"Ragnar","value":42.0},{"guaranteed":true,"key":"Ivar","value":35.0}] |
| Vestfold | [{"guaranteed":true,"key":"Harald","value":25.0},{"guaranteed":true,"key":"Floki","value":12.0}] |