From the course: Splunk Core Certified User (SPLK-1001) Cert Prep

Unlock this course with a free trial

Join today to access over 25,500 courses taught by industry experts.

Using the rare command

Using the rare command - Splunk Tutorial

From the course: Splunk Core Certified User (SPLK-1001) Cert Prep

Start my 1-month free trial Buy for my team

Using the rare command

“

So, we just discussed that we can use the top command to get statistics for the top or most common values of a field. Now, what if you actually wanted to get statistics for the least or rare values of a field? So there is a command for that as well, known as the rare command. So it's really just a command on the other side of the spectrum, which returns statistics or a table for rare or least common values of a field. Now the constraints that you use for the rare command are exactly the same kind of constraints that we saw for the top command. So the limit argument is going to work exactly the same way. The showPercent argument and the countField argument are going to work exactly the same way. Let's look at an example here. So before, we had, for example, top limit equal to 5 and then responseCode. And that was giving us statistics for the top or most common five values of the responseCode field. Now when we use the rare command, we are going to return those statistics for the bottom…

Contents