JSON jq magic for journalctl. https://blog.kylemanna.com/linux/systemd-journalctl-sort-by-frequency

journalctl-sort-by-program-frequency.jq

#
# Read from journalctl outputting json and sort the data by program frequency
#
# https://blog.kylemanna.com/linux/systemd-journalctl-sort-by-frequency
#
# Author: Kyle Manna
#
# invocation: journalctl -o json --since "1 month ago" | jq -s -f systemd-journalctl-sort-by-program-frequency.jq
#

# Grab the most useful name and a pointer/cursor to each occurrence
[.[] | { name: (if .SYSLOG_IDENTIFIER then .SYSLOG_IDENTIFIER else ._COMM end), cursor:.__CURSOR }] 

# Group by name
| group_by(.name)

# Collapse the grouping in to a simple { name: $NAME, length: XX } object
| map({name: .[0].name, length: [.[].cursor] | length})

# Sort by length
| sort_by(.length)