#logtype = "talon" | eventDetails.protocol="http" | top(url)

#logtype = "talon"| severity = "veryHigh"
| groupBy(deviceHostname)

#logtype = "talon" | severity = "veryHigh" | timechart(function=count())

#logtype = "talon" | type = "audit" | timechart()

#logtype = "talon" | eventCategory = "policyRules"
| head(10)
| select([@timestamp, eventType, description])

#logtype = "talon" | top(eventType)

#logtype = "talon" | top(url)