This query uses Zeek DNS logs to see which hosts on your network are making the most DNS requests. Although simple, it does a good job of demonstrating the ax, stats, and alias modules. here…
tag=zeekdns ax
| alias orig Host
| stats count by Host
| table Host count