get_field_values_with_count
Retrieves distinct field values with occurrence counts to analyze top event codes, hosts, or users within a specified time range.
Instructions
Return distinct field values together with their occurrence counts (terms aggregation). Great for 'top event codes', 'events per host', 'users seen', etc. Example: index='v11-log-wineventlog-*', field='log.eventCode'. server: which configured server to target (default active/default).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | now | |
| top | No | ||
| field | Yes | ||
| index | Yes | ||
| start | No | now-24h | |
| server | No | ||
| filters | No | ||
| order_by_count | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |