Skip to content

Latest commit

 

History

History
101 lines (73 loc) · 2.58 KB

File metadata and controls

101 lines (73 loc) · 2.58 KB

rare

Table of contents

Using rare command to find the least common tuple of values of all fields in the field list.

Note: A maximum of 10 results is returned for each distinct tuple of values of the group-by fields.

rare <field-list> [by-clause]

rare <field-list> [rare-options] [by-clause] (available from 3.1.0+)

  • field-list: mandatory. comma-delimited list of field names.
  • by-clause: optional. one or more fields to group the results by.
  • rare-options: optional. options for the rare command. Supported syntax is [countfield=<string>] [showcount=<bool>].
  • showcount=<bool>: optional. whether to create a field in output that represent a count of the tuple of values. Default value is true.
  • countfield=<string>: optional. the name of the field that contains count. Default value is 'count'.

The example finds least common gender of all the accounts.

PPL query:

os> source=accounts | rare gender;
fetched rows / total rows = 2/2
+--------+
| gender |
|--------|
| F      |
| M      |
+--------+

The example finds least common age of all the accounts group by gender.

PPL query:

os> source=accounts | rare age by gender;
fetched rows / total rows = 4/4
+--------+-----+
| gender | age |
|--------+-----|
| F      | 28  |
| M      | 32  |
| M      | 33  |
| M      | 36  |
+--------+-----+

The example finds least common gender of all the accounts when plugins.calcite.enabled is true.

PPL query:

PPL> source=accounts | rare gender;
fetched row
+--------+-------+
| gender | count |
|--------+-------|
| F      | 1     |
| M      | 3     |
+--------+-------+

The example specifies the count field when plugins.calcite.enabled is true.

PPL query:

PPL> source=accounts | rare countfield='cnt' gender;
fetched row
+--------+-----+
| gender | cnt |
|--------+-----|
| F      | 1   |
| M      | 3   |
+--------+-----+

The rare command is not rewritten to OpenSearch DSL, it is only executed on the coordination node.