How to do Top N per time bucket in KQL? - azure-data-explorer

Question

I want to group by time bucket and one other column and then only select the top N aggregated rows.
It's best explained with this example:
let T = datatable(d:datetime , continent:string, country:string, val:int)
[
datetime(2022-10-05T01:40:00.00), "Asia", "China", 10,
datetime(2022-10-05T02:50:00.00), "Asia", "India", 25,
datetime(2022-10-05T03:55:00.00), "Asia", "Japan", 15,
datetime(2022-10-05T01:40:00.00), "Europe", "Czech Republic", 1,
datetime(2022-10-05T02:50:00.00), "Europe", "France", 8,
datetime(2022-10-05T07:55:00.00), "Europe", "Germany", 9,
datetime(2022-10-05T04:55:00.00), "North America", "USA", 25,
datetime(2022-10-05T05:55:00.00), "North America", "Haiti", 5,
datetime(2022-10-05T09:55:00.00), "North America", "Jamaica", 3,
datetime(2022-10-06T01:40:00.00), "Asia", "China", 7,
datetime(2022-10-06T02:50:00.00), "Asia", "India", 8,
datetime(2022-10-06T03:55:00.00), "Asia", "Japan", 15,
datetime(2022-10-06T01:40:00.00), "Europe", "Czech Republic", 29,
datetime(2022-10-06T02:50:00.00), "Europe", "France", 14,
datetime(2022-10-06T07:55:00.00), "Europe", "Germany", 13,
datetime(2022-10-06T04:55:00.00), "North America", "USA", 12,
datetime(2022-10-06T05:55:00.00), "North America", "Haiti", 7,
datetime(2022-10-06T09:55:00.00), "North America", "Jamaica", 4,
];
T
| summarize sumval = sum(val) by bin(d,1d), continent
| sort by d asc, sumval desc
This is the result, but I only want the top 2 results per day (highlighted).
In SQL I would use either row_number or cross apply, but I've been struggling in KQL. I want to understand the solution, because it doesn't click yet.

Answer 1

top-nested operator
Please note that in you case you don't really need the 1st sum(val), but it was added since the syntax mandates something there.
We could have used count(), 0, int(null) or other options for that matter.
let T = datatable(d:datetime , continent:string, country:string, val:int)
[
datetime(2022-10-05T01:40:00.00), "Asia", "China", 10,
datetime(2022-10-05T02:50:00.00), "Asia", "India", 25,
datetime(2022-10-05T03:55:00.00), "Asia", "Japan", 15,
datetime(2022-10-05T01:40:00.00), "Europe", "Czech Republic", 1,
datetime(2022-10-05T02:50:00.00), "Europe", "France", 8,
datetime(2022-10-05T07:55:00.00), "Europe", "Germany", 9,
datetime(2022-10-05T04:55:00.00), "North America", "USA", 25,
datetime(2022-10-05T05:55:00.00), "North America", "Haiti", 5,
datetime(2022-10-05T09:55:00.00), "North America", "Jamaica", 3,
datetime(2022-10-06T01:40:00.00), "Asia", "China", 7,
datetime(2022-10-06T02:50:00.00), "Asia", "India", 8,
datetime(2022-10-06T03:55:00.00), "Asia", "Japan", 15,
datetime(2022-10-06T01:40:00.00), "Europe", "Czech Republic", 29,
datetime(2022-10-06T02:50:00.00), "Europe", "France", 14,
datetime(2022-10-06T07:55:00.00), "Europe", "Germany", 13,
datetime(2022-10-06T04:55:00.00), "North America", "USA", 12,
datetime(2022-10-06T05:55:00.00), "North America", "Haiti", 7,
datetime(2022-10-06T09:55:00.00), "North America", "Jamaica", 4,
];
T
| top-nested of bin(d, 1d) by sum(val), top-nested 2 of continent by sum(val)
d
aggregated_d
continent
aggregated_continent
2022-10-05T00:00:00Z
101
Asia
50
2022-10-05T00:00:00Z
101
North America
33
2022-10-06T00:00:00Z
109
Europe
56
2022-10-06T00:00:00Z
109
Asia
30
Fiddle