Splunk Search

How do I chart rare values?

jonkeiser
Engager

Hello!

I'm fairly new to Splunk, and I'm using my Minecraft server logs to chart some data. I am having a hard time charting rare values. Here is the search I'm trying:

index=minecraft action=block_broken
| rare block_type
| chart count(block_type) over player by block_type useother=f

This does not work. I know I'm doing this incorrectly, but I'm not sure how, exactly. Any tips would be greatly appreciated!

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jonkeiser,
after rare command you have only three fields: block_type, count and percent; so you don't have field "player" more.
You should use a different approach, something like

index=minecraft action=block_broken
| chart count(block_type) over player by block_type useother=f

Bye.
Giuseppe

0 Karma

jonkeiser
Engager

This won't return the rare values, though, which is what I need. I am already using that search to return the top values.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...