Try this. Hope this is what you are looking for
index= aab sourcetype=topconnections earliest=-10m latest=-5m
| table SESSION_AUTH_ID , CONNECTION_COUNT
|eventstats sum(CONNECTION_COUNT) as TotalCount
| where TotalCount> 200
| sort - CONNECTION_COUNT
| head 5
... View more