Splunk Search

How do I chart rare values?

jonkeiser
Engager

Hello!

I'm fairly new to Splunk, and I'm using my Minecraft server logs to chart some data. I am having a hard time charting rare values. Here is the search I'm trying:

index=minecraft action=block_broken
| rare block_type
| chart count(block_type) over player by block_type useother=f

This does not work. I know I'm doing this incorrectly, but I'm not sure how, exactly. Any tips would be greatly appreciated!

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jonkeiser,
after rare command you have only three fields: block_type, count and percent; so you don't have field "player" more.
You should use a different approach, something like

index=minecraft action=block_broken
| chart count(block_type) over player by block_type useother=f

Bye.
Giuseppe

0 Karma

jonkeiser
Engager

This won't return the rare values, though, which is what I need. I am already using that search to return the top values.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...