This page explains how to use the top operator function in APL.
top
operator in Axiom Processing Language (APL) allows you to retrieve the top N rows from a dataset based on specified criteria. It is particularly useful when you need to analyze the highest values in large datasets or want to quickly identify trends, such as the highest request durations in logs or top error occurrences in traces. You can apply it in scenarios like log analysis, security investigations, or tracing system performance.
Splunk SPL users
top
operator in APL is similar to top
in Splunk SPL but allows greater flexibility in specifying multiple sorting criteria.ANSI SQL users
TOP
operator is used with an ORDER BY
clause to limit the number of rows. In APL, the syntax is similar but uses top
in a pipeline and specifies the ordering criteria directly.N
: The number of rows to return.Expression
: A scalar expression used for sorting. The type of the values must be numeric, date, time, or string.[asc | desc]
: Optional. Use to sort in ascending or descending order. The default is descending.top
operator returns the top N rows from the dataset based on the specified sorting criteria.
top
operator helps you find the HTTP requests with the longest durations.Query_time | req_duration_ms | id | status | uri | method | geo.city | geo.country |
---|---|---|---|---|---|---|---|
2024-10-01 10:12:34 | 5000 | 123 | 200 | /api/get-data | GET | New York | US |
2024-10-01 11:14:20 | 4900 | 124 | 200 | /api/post-data | POST | Chicago | US |
2024-10-01 12:15:45 | 4800 | 125 | 200 | /api/update-item | PUT | London | UK |