topic Re: List fields after rare command in Splunk Search

List fields after rare command

bmer — Sun, 21 Dec 2025 16:22:22 GMT

Hi,

Iam using below splunk to help identify least common values of runTime field in myEventRecType file . i get the results .

However I would like to also show additional fields related to the runTime like requestId, queryExecutionTime,TimeOfExecution. How can I get them added?

Index=abc source=xxx earliest=-60m EventRecType=xyz | rare runTime limit=5

Thanks!

Re: List fields after rare command

ITWhisperer — Sun, 21 Dec 2025 17:47:56 GMT

Perhaps the simplest way to do this is with a subsearch, however, there are limits to the number of events so this may not work for your usecase

Index=abc source=xxx earliest=-60m EventRecType=xyz [search Index=abc source=xxx earliest=-60m EventRecType=xyz | rare runTime limit=5 | fields runTime | format]

Re: List fields after rare command

PickleRick — Mon, 22 Dec 2025 19:24:57 GMT

You can't "add" fields to the results. It wouldn't make sense anyway since "rare" is a transforming command and does aggregation on the original data so other fields' values do not correspond 1:1 to the aggregations.

What you might try doing instead is using stats (or eventstats but that's more limited).

For example:

index=abc source=xxx earliest=-60m EventRecType=xyz | stats count values(otherField) as otherField values(anotherField) as anotherField by runTime | sort runTime | head 5

EDIT: I'm not editing the search because @ITWhisperer 's remark will stop making sense but indeed - the sort is on runTime whereas it should be on count.

Re: List fields after rare command

ITWhisperer — Mon, 22 Dec 2025 10:14:19 GMT

I think you probably would want to sort by count not runTime and you can do the head in the sort

index=abc source=xxx earliest=-60m EventRecType=xyz | stats count values(otherField) as otherField values(anotherField) as anotherField by runTime | sort 5 count

Re: List fields after rare command

PickleRick — Mon, 22 Dec 2025 11:26:25 GMT

You're 100% right. Since we want the rarest ones, we need to sort on count. It was late when I wrote this 😉