rare

Find the least common values of a field. The inverse of top.

Syntax

| rare [N] <field> [BY <split-field>]

Default: N = 10.

Examples

-- Least common status codes
source=nginx | rare status

-- Rarest 5 error messages
level=error | rare 5 message

-- Rare values per source
| rare 10 uri by source

See Also

• top -- Most common values
• stats -- General aggregation