Popular labels alternative
select regexp_extract(qname, '([a-zA-Z0-9-_]*)\..*\.nl.',1) as reg, count(*) as totals from (select qname from dns.queries where year = 2017 and month = 9 group by qname ) as tmp group by reg order by totals desc
www 12038391 2 _sidn 7494869 3 _dmarc 4077681 4 mail 3442614 5 ftp 1154985 6 smtp 1140153 7 mx 1086447 8 webmail 780388 9 _sipfederationtls 549728 10 imap 546192 11 _adsp 513951 12 _sip 501605 13 mail2 331740 14 mail1 291840 15 pop 276053 16 m 261366 17 _xmpp-server 237257 18 _jabber 236479 19 _xmpp-client 236017 20 _sips 232519 21 mx1 218801 22 ww 213928 23 autodiscover 206929 24 _ssp 194640 25 mx2 179434 26 msoid 152917 27 _kerberos 139588 28 shop 137714 29 owa 130110 30 forum 124771 31 sip 123660 32 blog 109871 33 cpanel 109371