Is it possible to get both rare and top results in the same search result table?

[sfatnass]

Hi,

I want to know if it's possible to get rare and top value on the same table search.

index=_internal |top limit=5 sourcetype
index=_internal |rare limit=5 sourcetype

thx

[aljohnson_splun · Accepted solution]

Hmm. Here is one way:

index=_internal
| top limit=2 sourcetype
| append [ search index=_internal | rare limit=2 sourcetype ]

[sfatnass]

thx aljhonson

[aljohnson_splun]

np @sfatnass