Select this in the fields sidebar to automatically pipe you search results to the rare command

Question

Options

• Aevents with this field
• Brare values
• Ctop values by time
• Dtop values

• A
  1% (1)
• B
  94% (65)
• C
  3% (2)
• D
  1% (1)

Explanation

In the Splunk fields sidebar, clicking 'rare values' for a given field automatically appends the | rare command to your search, showing the least common values for that field. 'Top values' pipes to the top command, 'top values by time' uses top with a time component, and 'events with this field' filters results to events containing that field-none of those invoke rare.

No community discussion yet for this question.