I have an index with ~200 fields and need to know the single most common non-null value for each field. How do I uncover that with Splunk?
In this example, I'd start here:
And would aim to end up here:
I don't have a test query to share since I'm not sure how to begin approaching this, and haven't seen anything on the forum here that is a close match. Would greatly appreciate any insights into how to get this done!
Try the stats command with the mode function.
| stats mode(Fruits) as Fruits, mode(Sizes) as Sizes, mode(Integers) as Integers