Thanks @chaker Unfortunately, your suggestion that still provide another way to express a table but only take the top 5 in alphabetic not in term of less or most use ... View more

Thanks @ITWhisperer , Great look like it is working! Interesting new approach that I will explore more.  I also add a total to sort it not sure it is the most efficient way but it did work.  index=aws sourcetype="aws:cloudtrail" | stats count by awsRegion account | eventstats sum(count) as total by awsRegion | sort 0 total awsRegion | streamstats dc(awsRegion) as rank | where rank < 5 | xyseries account awsRegion count | addtotals fieldname=TotalEvents | eval TotalEvents=TotalEvents-account | sort TotalEvents ... View more