Examples - Top N

function countBySource()
  search
  let source=f("@source"), timestamp=f("@timestamp")
  aggregate count=count() by source
  sort 10 count
end
stream eventCount=countBySource()

function countBySource()
  search
  let source=f("@source"), timestamp=f("@timestamp")
  timechart {span="1h", limit=10} count=count() by source
end

function sizeBySource()
  search
  let source=f("@source"), size=f("__size__"), timestamp=f("@timestamp")
  timechart {span="1h", limit=10} size=sum(size) by source
end

env from="-48h>h", to=">h"
stream eventCount=countBySource()
stream eventSize=sizeBySource()