frequent
Use the frequent command to display n results of the
        most frequent values of all fields in the field list. You can optionally group by additional
        fields.
               
Syntax
frequent [<frequent_options>] <field_name> [, <field_name>), ...] [as <new_field_name>] [by <field_name> [, <field_name>]*]Parameters
The following table lists the parameters used in this command, along with their descriptions.
| Parameter | Description | 
|---|---|
| 
 
  | 
 Specify the field whose frequent values must be determined.  | 
| 
 
  | 
 Syntax: [limit =
                                        <limit>] [showcount =
                                    [true|false]] [showpercent =
                                        [true|false]]
 
 
  | 
The following queries return 10 entities with severity values of the highest frequency:
With link command:
                  
* | link Entity
    | stats latest(Severity) as Severity
    | frequent Severity
Without link command: 
                  
* | stats latest(Severity) as Severity by Entity
    | frequent Severity