Count by month with average over time(`ntsb_index` sourcetype="ntsb_csv")
| timechart count span=1mon as Count
| streamstats global=f avg(Count) as Average
| eval Average = round(Average)$field1.earliest$$field1.latest$1All by Airport NameAll by City, StateTotal Fatalities
Top-20 by Airport Code(`ntsb_index` sourcetype="ntsb_csv")
| sort - count
| top limit=20 "Airport Code"$field1.earliest$$field1.latest$1Top-20 by State(`ntsb_index` sourcetype="ntsb_csv")
| sort -count
| top limit=20 "State"$field1.earliest$$field1.latest$1Top-50 by City, State(`ntsb_index` sourcetype="ntsb_csv")
| sort - count
| eval city_state = City + ", " + State
| top limit=50 city_state$field1.earliest$$field1.latest$1Count by Event Date| pivot ntsb_w_Event_Date RootObject count(RootObject) AS "Count of ntsb_w_Event_Date" SPLITROW _time AS _time PERIOD auto SORT 0 _time ROWSUMMARY 0 COLSUMMARY 0 SHOWOTHER 1$field1.earliest$$field1.latest$1Investigation Type by Country(`ntsb_index` sourcetype="ntsb_csv")
| chart count by "Investigation Type", Country limit=0$field1.earliest$$field1.latest$1