Skip to main content
The topkif aggregation in Axiom Processing Language (APL) allows you to identify the top k values based on a specified field, while also applying a filter on another field. Use topkif when you want to find the most significant entries that meet specific criteria, such as the top-performing queries from a particular service, the most frequent errors for a specific HTTP method, or the highest latency requests from a specific country. Use topkif when you need to focus on the most important filtered subsets of data, especially in log analysis, telemetry data, and monitoring systems. This aggregation helps you quickly zoom in on significant values without scanning the entire dataset.
The topkif aggregation in APL is a statistical aggregation that returns estimated results. The estimation provides the benefit of speed at the expense of precision. This means that topkif is fast and light on resources even on large or high-cardinality datasets but does not provide completely accurate results.For completely accurate results, use the top operator together with a filter.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
Splunk SPL does not have a direct equivalent to the topkif function. You can achieve similar results by using the top command combined with a where clause, which is closer to using APL’s top operator with a filter. However, APL’s topkif provides a more optimized, estimated solution when you want speed and efficiency.
| where method="GET" | top limit=5 status
In ANSI SQL, identifying the top k rows filtered by a condition often involves a WHERE clause followed by ORDER BY and LIMIT. APL’s topkif simplifies this by combining the filtering and top-k selection in one function.
SELECT status, COUNT(*)
FROM sample_http_logs
WHERE method = 'GET'
GROUP BY status
ORDER BY COUNT(*) DESC
LIMIT 5;

​
Usage

​
Syntax

topkif(Field, k, Condition)

​
Parameters

  • Field: The field or expression to rank the results by.
  • k: The number of top results to return.
  • Condition: A logical expression that specifies the filtering condition.

​
Returns

A subset of the original dataset containing the top k values based on the specified field, after applying the filter condition.

​
Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Use topkif when analyzing HTTP logs to find the top 5 most frequent HTTP status codes for GET requests.Query
['sample-http-logs']
| summarize topkif(status, 5, method == 'GET')
Run in PlaygroundOutput
statuscount_
200900
404250
500100
30190
30260
This query groups GET requests by HTTP status and returns the 5 most frequent statuses.

​
List of related aggregations

  • topk: Returns the top k results without filtering. Use topk when you do not need to restrict your analysis to a subset.
  • top: Returns the top results based on a field with accurate results. Use top when precision is important.
  • sort: Sorts the dataset based on one or more fields. Use sort if you need full ordered results.
  • extend: Adds calculated fields to your dataset, useful before applying topkif to create new fields to rank.
  • count: Counts occurrences in the dataset. Use count when you only need counts without focusing on the top entries.`