Popular labels alternative version

Popular labels alternative

select regexp_extract(qname, '([a-zA-Z0-9-_]*)\..*\.nl.',1) as reg, count(*) as totals
from (select qname
from dns.queries
where year = 2017 and month = 9
group by qname
) as tmp
group by reg
order by totals desc

www 12038391
2 _sidn 7494869
3 _dmarc 4077681
4 mail 3442614
5 ftp 1154985
6 smtp 1140153
7 mx 1086447
8 webmail 780388
9 _sipfederationtls 549728
10 imap 546192
11 _adsp 513951
12 _sip 501605
13 mail2 331740
14 mail1 291840
15 pop 276053
16 m 261366
17 _xmpp-server 237257
18 _jabber 236479
19 _xmpp-client 236017
20 _sips 232519
21 mx1 218801
22 ww 213928
23 autodiscover 206929
24 _ssp 194640
25 mx2 179434
26 msoid 152917
27 _kerberos 139588
28 shop 137714
29 owa 130110
30 forum 124771
31 sip 123660
32 blog 109871
33 cpanel 109371