top operator

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Returns the first N records sorted by the specified column.

Syntax

T | top NumberOfRows by Expression [asc | desc] [nulls first | nulls last]

Name	Type	Required	Description
T	`string`	✔️	The tabular input to sort.
NumberOfRows	`int`	✔️	The number of rows of T to return.
Expression	`string`	✔️	The scalar expression by which to sort.
`asc` or `desc`	`string`		Controls whether the selection is from the "bottom" or "top" of the range. Default `desc`.
`nulls first` or `nulls last`	`string`		Controls whether null values appear at the "bottom" or "top" of the range. Default for `asc` is `nulls first`. Default for `desc` is `nulls last`.

Tip

top 5 by name is equivalent to the expression sort by name | take 5 both from semantic and performance perspectives.

Show top three storms with most direct injuries.

StormEvents
| top 3 by InjuriesDirect

The below table shows only the relevant column. Run the query above to see more storm details for these events.