top command
Note
To see which AWS data source integrations support this PPL command, see Commands.
Use the top command to find the most common tuple of values of
all fields in the field list.
Syntax
Use the following syntax:
top [N] <field-list> [by-clause] top_approx [N] <field-list> [by-clause]
N
-
The number of results to return.
-
Default: 10
field-list
-
Mandatory.
-
A comma-delimited list of field names.
by-clause
-
Optional.
-
One or more fields to group the results by.
top_approx
-
An approximate count of the (n) top fields by using the estimated cardinality by HyperLogLog++ algorithm
.
Example 1: Find the most common values in a field
The example finds the most common gender for all accounts.
PPL query:
os> source=accounts | top gender; os> source=accounts | top_approx gender; fetched rows / total rows = 2/2 +----------+ | gender | |----------| | M | | F | +----------+
Example 2: Find the most common values in a field (limited to 1)
The example finds the single most common gender for all accounts.
PPL query:
os> source=accounts | top_approx 1 gender; fetched rows / total rows = 1/1 +----------+ | gender | |----------| | M | +----------+
Example 3: Find the most common values, grouped by gender
The example finds the most common age for all accounts, grouped by gender.
PPL query:
os> source=accounts | top 1 age by gender; os> source=accounts | top_approx 1 age by gender; fetched rows / total rows = 2/2 +----------+-------+ | gender | age | |----------+-------| | F | 28 | | M | 32 | +----------+-------+
