> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/approx_top.md). # approx\_top **Syntax** **comp approx\_top as count** ```programlisting comp approx_top(, ) [as ] [by [,...]][addrawdata = true|false [as ]] ``` **comp approx\_top as sum** ```programlisting comp approx_top(, , ) [as ] [by [,...]][addrawdata = true|false [as ]] ``` **Description** The `approx_top` approximate aggregate is a [comp function](/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/stages/comp.md) that, depending on the number of parameters, returns either an approximate count or sum of top elements. This approximate aggregate function returns a single value for the given field over a group of rows, for all records that contain matching values for the fields identified in the `by` clause. This function is used in combination with a `comp` stage. When a third parameter is specified, it references a field that contains a numeric value (weight) that is used to calculate a sum. The return value is an array with up to `` of JSON strings. Each string represents an object (struct) containing 2 keys and corresponding values. The keys depend on whether a third parameter has been supplied or not. When defining `approx_top` to count and the third parameter is omitted, each struct will have these keys: "value" and "count", where the "value" specifies a unique field value and "count" specifies the number of occurrences. When the third parameter is specified in `approx_top`, it has to be a name of a field that contains a numeric value that is used to calculate the final sum for each unique value in the first specified field. Each struct in this case will have these keys: "value" and "sum". In addition, you can configure whether the raw data events are displayed by setting `addrawdata` to either `true` or `false` (default), which are used to configure the final `comp` results. When including raw data events in your query, the query runs for up to 50 fields that you define and displays up to 100 events. Use this approximate aggregate function to produce approximate results, instead of exact results used with regular aggregate functions, which are more scalable in terms of memory usage and time. **Examples** **comp approx\_top as count** Returns an approximate count of the top 10 agent IDs in the `agent_id` field that appear the most frequently. The return value is an array containing 10 JSON strings with a "value" and "count". ```programlisting dataset = xdr_data | fields agent_id | comp approx_top(agent_id, 10) ``` **comp approx\_top as sum** Returns an approximate sum of the top 10 agent IDs in the `agent_id` field by their `action_session_duration`. The return value is an array containing 10 JSON strings with a "value" and "sum" for each `agent_id`. ```programlisting dataset = xdr_data | fields agent_id, action_session_duration | comp approx_top(agent_id, 10, action_session_duration) ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/cortex-xdr-xql/functions/approx_top.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.