rare

This search command creates a table of statistics and a corresponding chart to display the least frequent values of a field. The command also supports the optional group by parameter to display the least frequent values for each distinct tuple of values of the group by field.

Syntax

In the preceding syntax, the following definitions apply:

• [expression] indicates it is optional.
• <int> refers to an integer value that represents the maximum number of results to return.
• by <field> refers to the group by parameter that can be optionally used to group the result set by the specified field.

Short examples

Example 1: Return the 10 least common values of the HOST field.

Example 2: Return the least common data pattern values for each host.

Example 3: Return the least common request type.

... | rare limit=1 RequestType

Example 4: Return the least common request type per client IP.

Long examples

The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the rare command. 

• Sample data
•  
• Sample indexed data
• Find least frequent values for a field
•  
• Find least frequent values for a field grouped by another field
•  

Sample data

Back to examples ↑

Sample indexed data

Back to examples ↑

Find least frequent values for a field

In this example, you use the command to see a table of statistics (and a multiseries chart) displaying the least common request types.

Command

Output

Back to examples ↑

Find least frequent values for a field grouped by another field

In this example, you use the command to see a table of statistics (and a multiseries chart) displaying the least common request types grouped by the ClientIp field.

Command

Output

Back to examples ↑

Note

If the number of occurrences of the field used for the by parameter is too large (for example, 500), then the count of values displayed is an approximate value.