Splunk Search

How do I chart rare values?

jonkeiser
Engager

Hello!

I'm fairly new to Splunk, and I'm using my Minecraft server logs to chart some data. I am having a hard time charting rare values. Here is the search I'm trying:

index=minecraft action=block_broken
| rare block_type
| chart count(block_type) over player by block_type useother=f

This does not work. I know I'm doing this incorrectly, but I'm not sure how, exactly. Any tips would be greatly appreciated!

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jonkeiser,
after rare command you have only three fields: block_type, count and percent; so you don't have field "player" more.
You should use a different approach, something like

index=minecraft action=block_broken
| chart count(block_type) over player by block_type useother=f

Bye.
Giuseppe

0 Karma

jonkeiser
Engager

This won't return the rare values, though, which is what I need. I am already using that search to return the top values.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...