---
name: azion-find-the-top-values-with-graphql
description: >-
  Rank the values of one request field, such as the most requested URIs, by counting the raw request records of the GraphQL API events endpoint.
---

# Find the top values with GraphQL

You can rank the values of one request field by the number of requests that carry each value, such as the most requested URIs. The [GraphQL API](/en/documentation/devtools/graphql/overview/) query counts the raw request records of the events endpoint. To follow a measure over time instead, refer to [Query aggregated data with GraphQL](/en/documentation/guides/platform/observability/graphql-aggregated-data/).

---

## Prerequisites

- A personal token. To create one, refer to [Personal tokens](/en/documentation/guides/platform/account-and-billing/personal-tokens/).
- A tool that sends a GraphQL query, such as an HTTP client or the GraphiQL Playground. For the setup, refer to [GraphQL API first steps](/en/documentation/devtools/graphql/first-steps/) or [Run GraphQL queries in Postman](/en/documentation/guides/platform/observability/query-graphql-postman/).
- An [application](/en/documentation/platform/applications/) that received requests in the past seven days. The events endpoint keeps records for about seven days.

---

## Rank the most requested URIs

The query counts the records of `workloadEvents`, one record per request, for each value of `requestUri`. It then returns the five values with the highest count. To run it:

1. **Address the request to the events endpoint**

   Send a `POST` request to `https://api.azion.com/v4/events/graphql` with the header `Authorization: Token [TOKEN VALUE]`. The metrics endpoint does not serve `workloadEvents` and returns `400` with `Cannot query field "workloadEvents" on type "Query".`

2. **Add the query**

   Paste the query in the request body. Change `tsRange` to a window inside the past seven days:

   ```graphql
   query EventsTopUri {
    workloadEvents(
      limit: 5,
      filter: {
        tsRange: {begin:"2026-09-26T14:00:00", end:"2026-10-03T14:00:00"}
      },
      aggregate: {count: requestUri}
      groupBy: [requestUri]
      orderBy: [count_DESC]
      )
    {
      requestUri
      count
    }
   }
   ```

   Each argument does one part of the ranking:

   | Argument                             | What it does                                                                                                                                                                                         |
   | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
   | `filter` with `tsRange`              | Sets the time window. A time filter is required: `tsRange`, or `tsGt` and `tsLt`. Without one, the API returns `400` with `To execute queries it is mandatory to provide the desired time interval.` |
   | `aggregate` with `count: requestUri` | Counts the records. The result comes back in the `count` field.                                                                                                                                      |
   | `groupBy: [requestUri]`              | Returns one row per value of `requestUri`. Without `groupBy`, the aggregate returns one row with the total for the whole window.                                                                     |
   | `orderBy: [count_DESC]`              | Sorts the rows from the highest count to the lowest.                                                                                                                                                 |
   | `limit: 5`                           | Keeps the first five rows.                                                                                                                                                                           |

3. **Send the request**

   The API returns one object per URI, with its request count. This response is cut after the third of its five rows:

   ```json
   {
     "data": {
       "workloadEvents": [
         {
           "requestUri": "/get",
           "count": 619
         },
         {
           "requestUri": "/en/documentation/",
           "count": 328
         },
         {
           "requestUri": "-",
           "count": 284
         },
         …
       ]
     }
   }
   ```

The first row of the response holds the most requested URI in the window.

---

## Rank another field

The same query ranks any field that `workloadEvents` accepts in `groupBy`. For the top 10 hosts, replace `requestUri` with `host` in `aggregate`, `groupBy`, and the selected fields, and set `limit: 10`. For the top status codes, use `status` the same way.

The fields of `workloadEvents` are listed on [Real-Time Events GraphQL API fields](/en/documentation/devtools/graphql/gql-real-time-events-fields/). The other raw datasets of the events endpoint are on [Datasets and query arguments](/en/documentation/devtools/graphql/features/).

---

## Next steps

- [Query aggregated data with GraphQL](/en/documentation/guides/platform/observability/graphql-aggregated-data.md): Sum a measure per time bucket from the metrics endpoint.
- [Find the top attacks with GraphQL](/en/documentation/guides/platform/observability/query-top-attacks-with-graphql.md): Rank the attacks that the WAF found in your traffic.
- [Find the IPs behind attack traffic](/en/documentation/guides/platform/observability/query-top-ips-attack-traffic-with-graphql.md): Count the requests of each client address that matched the WAF.
- [Queries](/en/documentation/devtools/graphql/queries.md): Compare the raw, aggregated, financial, and usage query shapes.