Splunk Search

How do I chart rare values?

jonkeiser
Engager

Hello!

I'm fairly new to Splunk, and I'm using my Minecraft server logs to chart some data. I am having a hard time charting rare values. Here is the search I'm trying:

index=minecraft action=block_broken
| rare block_type
| chart count(block_type) over player by block_type useother=f

This does not work. I know I'm doing this incorrectly, but I'm not sure how, exactly. Any tips would be greatly appreciated!

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jonkeiser,
after rare command you have only three fields: block_type, count and percent; so you don't have field "player" more.
You should use a different approach, something like

index=minecraft action=block_broken
| chart count(block_type) over player by block_type useother=f

Bye.
Giuseppe

0 Karma

jonkeiser
Engager

This won't return the rare values, though, which is what I need. I am already using that search to return the top values.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...