rare
Shows the least common values. The dual to top
.
Description
Shows the least common values for a given field. For each unique value, a new
event containing its count will be produced. In general, rare x
is equivalent
to:
Potentially High Memory Usage
Take care when using this operator with large inputs.
x: field
The name of the field to find the least common values for.
Examples
Find the least common values for x
.
Show the five least common values for id.orig_h
: