Find similar pattern in query- which one it used most?

[indeed_2000]

Hi I have table like below, each word is parameter of a search query, now want to know which  of them mostly use?

SPL | table a b c d e f 

FYI: some these field are empty, some of them partially like each other. Need to find most use pattern on this table.

Any idea?

Thanks

[ITWhisperer]

What do you mean by pattern?

Do you want the most common value of a, the most common value of b, etc.?

Or the most common value of a, b, c, d, e, f combined?

Or, given that some are empty some or all of the time, the most common non-empty fields regardless of value?

Or, something else?

[indeed_2000]

1-Most common of all of them, and one of them.

2-some times empty but each of them have value on different time.

[ITWhisperer]

| eval all=mvappend(a, b, c, d, e, f)
| stats mode(a) as a mode(b) as b mode(c) as c mode(d) as d mode(e) as e mode(f) as f mode(all) as all

[indeed_2000]

i’m look for something like exist on pattern tab, show percentage of each pattern.

[ITWhisperer]

I think this has come up before and it is possibly even probably proprietary to Splunk - however, if you can decide what sort of pattern you are looking for, perhaps you can design your own search, may be along the lines I have outlined or similar.