How to get the Top N in KQL with the top operator

The top operator in KQL is the fastest way to answer ranking questions such as "which 5 products have the highest revenue?" or "which are the 10 most recent events?". In this guide you will learn, step by step, how to get the Top N in KQL with the top operator, from the simplest example to ordering data that has already been aggregated.

Prerequisites

• Access to a KQL environment: an Azure Data Explorer cluster, an Eventhouse in Microsoft Fabric (Real-Time Analytics) or the free demo environment.
• A table to query. In this example we use a Vendas table with the columns Data, Produto, Categoria, Receita and Unidades.
• Knowing how to write and run a KQL query — remember that the | symbol connects each step of the pipeline.

Step 1: Understand the syntax of the top operator

The top operator does two things at once: it sorts the data and returns only the first rows. The syntax is straightforward:

NomeDaTabela
| top N by Expressao [asc | desc]

N is the number of rows you want (for example, 5). After by you state the column or expression used as the sort criterion. Use desc to go from highest to lowest (the most common case) and asc for the opposite. If you do not state the direction, KQL sorts in descending order by default.

Step 2: Get the Top 5 by a column

Let's start with the most direct question: which are the 5 sales with the highest revenue? Write:

Vendas
| top 5 by Receita desc

The result is exactly 5 rows, ordered from the highest revenue to the lowest. Notice how top replaces the combination of sorting and limiting: in a single line you get the same as you would with sort by Receita desc followed by take 5, but in a more readable and efficient way.

And what about ties? If several records share the same Receita, top may pick any of them for the last positions. When you need a predictable tie-breaker across more than one column, use sort with several keys followed by take instead:

Vendas
| sort by Receita desc, Data desc
| take 5

Step 3: Filter first and choose the columns

You rarely want the Top N over the whole table. The usual approach is to filter first with where and show only the useful columns with project. For example, the Top 3 sales in the "Software" category from 2026 onwards:

Vendas
| where Categoria == "Software"
| where Data >= datetime(2026-01-01)
| top 3 by Receita desc
| project Data, Produto, Receita

Order matters: first we cut down the rows with where, then we apply top, and only at the end do we choose the columns with project. That way the engine works over less data and the query runs faster.

Step 4: Top N after aggregating data

Often the business question is not about individual rows but about totals: "which 5 products earned the most?". For that, we first sum revenue per product with summarize and only then apply top:

Vendas
| summarize ReceitaTotal = sum(Receita) by Produto
| top 5 by ReceitaTotal desc

The summarize creates one row per product with the revenue sum; top keeps the 5 largest. This pattern — aggregate and then sort — solves most of the rankings you will need to build.

Tip: if you need the Top N within each group (for example, the 3 best-selling products of each category), there is the top-nested operator, made precisely for that case.

Check the result

To confirm the query is correct, check three things. First, the number of rows returned should equal the N you asked for (or fewer, if the table has fewer rows). Second, look at the sort column: with desc, the values should decrease from row to row. Third, to validate Step 4, swap top for count and confirm there are more products than the 5 shown — proof that the ranking is really filtering:

Vendas
| summarize ReceitaTotal = sum(Receita) by Produto
| count

Conclusion

With the top operator you can already answer ranking questions in KQL cleanly: pick the Top N by a column, filter first with where, and sort totals after summarize. The natural next step is to explore top-nested for rankings within each group and the render operator to turn these results into a bar chart. What will be the first ranking you need to build with your data?