top

Shows the most common values. The dual to rare.

Synopsis

top <field> [--count-field=<count-field>|-c <count-field>]

Description

Shows the most common values for a given field. For each unique value, a new event containing its count will be produced.

<field>

The name of the field to find the most common values for.

--count-field=<count-field>|-c <count-field>

An optional argument specifying the field name of the count field. Defaults to count.

The count field and the value field must have different names.

Examples

Find the most common values for field id.orig_h.

top id.orig_h

Find the most common values for field count and present the value amount in a field amount.

top count --count-field=amount