window.most_common_number

Supported in:

Rules Search

window.most_common_number(numbers, how_many_to_retrieve)

Description

Return the specified number of most common integers or floats in the input values.

Param data types

INT|FLOAT, INT

Return type

ARRAY_FLOATS

Code samples

Example 1

Top 1 This rule sets the value of the outcome variable $p1 to an array containing just the most common file size

events:
 $e.user.userid = $userid
match:
 $userid over 5m
outcome:
  $p1 = window.most_common_number($e.file.size, 1) // yields 66 if the event file size values in the match window are 33, 33, 66, 66, 66 and 1.
condition:
  $e

Example 2

Here, number of retrieves more than number of file sizes.

events:
 $e.user.userid = $userid
match:
 $userid over 5m
outcome:
  $p100 = window.most_common_number($e.file.size, 100) // yields [15.130000, 9.180000, 1.000000] if the event file size values in the match window are [9.18, 9.18, 15.13, 15.13, 15.13, 1.00].
condition:
  $e

Example 3

Default values are not ignored so a lot of times the top value will be 0 (adjust the second arg accordingly).

events:
 $e.user.userid = $userid
match:
 $userid over 5m
outcome:
  $p1 = window.most_common_number($e.file.size, 1) // yields [0] if the event file size values in the match window are [0, 0, NULL, 123].
condition:
  $e