A quick way to get a summarized table based on the fields is by using the top and rare commands. Run this search command:
SPL> index=main | top http_uri
Notice that the result automatically grouped the URLs by count, calculated the percentage of each row against the whole data set, and sorted them by count in descending order. You can see a sample result in the following screenshot:
You may further tweak this search command by adding command options such as limit and showperc. Say, for example, you only want to see the top five URLs, but you do not want to see the percent column. This is the SPL to achieve that:
SPL> index=main | top url limit=5 showperc=false
Now try the same commands, but use rare instead of top. The term rare will find those events that are the most unlikely ones. This can be a useful qualifier to use for determining...
