frequent
Use the frequent
command to display n results of the
most frequent values of all fields in the field list. You can optionally group by additional
fields.
Syntax
frequent [<frequent_options>] <field_name> [, <field_name>), ...] [as <new_field_name>] [by <field_name> [, <field_name>]*]
Parameters
The following table lists the parameters used in this command, along with their descriptions.
Parameter | Description |
---|---|
|
Specify the field whose frequent values must be determined. |
|
Syntax: [limit =
<limit>] [showcount =
[true|false]] [showpercent =
[true|false]]
|
The following queries return 10 entities with severity values of the highest frequency:
With link
command:
* | link Entity
| stats latest(Severity) as Severity
| frequent Severity
Without link
command:
* | stats latest(Severity) as Severity by Entity
| frequent Severity