rare command

[Shakira1]

hello!

I have this search, and I want to add more parameters like time etc.

the thing is - when I'm using rare its show only the SHA256HashData and count

```index=myindex
| stats count by SHA256HashData
| rare SHA256HashData

any idea?

thanks! 

[richgalloway]

Why did you not include all of that in the OP?  You could have had a solution many hours sooner.

index=myindex earliest=-24h
``` Count each hash value ```
| eventstats count by SHA256HashData
``` Find the hash value with the lowest count ```
| eventstats min(count) as minCount
``` Keep the hashes with the lowest count ```
| where count=minCount
| collect index=summary

[Shakira1]

when I run your search I got too many results ,

with rare I got only 10 results.

there is no options to use rare and add more fields to the table?

[richgalloway]

Use the head command to limit the number of results.  The rare does not do what you want it to do because it discards fields and once fields are discarded they cannot be retrieved again.

index=myindex earliest=-24h
``` Count each hash value ```
| eventstats count by SHA256HashData
``` Find the hash value with the lowest count ```
| eventstats min(count) as minCount
``` Keep the hashes with the lowest count ```
| where count=minCount
| head 10
| collect index=summary

[Shakira1]

but I want to get the most unique SHA256HashData in the last 24h for example. and then fwd to summary index and start static about it, so for that I need to get more data

[richgalloway]

Both stats and rare are transforming commands, meaning only the fields used in or produced by the commands are available to later commands.  So the only fields available after stats are count and SHA256HashData; and the only fields available after rare are SHA256HashData, count, and percent.

To get additional fields out of stats, include them in the command.  To work around rare, use sort and tail.

index=myindex
| stats count, max(_time) as _time by SHA256HashData
| sort - SHA256HashData
| tail 10