index="redshift" source="mi_input://RASDB-Input-sometext-*"|lookup country_lookup abbreviation as ID OUTPUT fullname as Country|eval Country=Country."[".ID."]" |rename CALL_COST as Currency| dedup Country |sort -Currency |head 10|table Country,Currency |where Currency!=0
