rare
Use the rare
command to display n results of the
least frequent values of all fields in the field list. You can optionally group by
additional fields.
Syntax
rare [<rare_options>] <field_name> [, <field_name>, ...] [as <new_field_name>] [by <field_name> [, <field_name>]*]
Parameters
The following table lists the parameters used in this command, along with their descriptions.
Parameter | Description |
---|---|
|
Specify the field whose rare values must be determined. |
|
Syntax: [limit =
<limit>] [showcount =
[true|false]] [showpercent =
[true|false]]
|
The following queries return 10 entities with severity values of the lowest frequency:
With link
command:
* | link Entity
| stats latest(Severity) as Severity
| rare Severity
Without link
command:
* | stats latest(Severity) as Severity by Entity
| rare Severity