Splunk Search

Is it possible to get both rare and top results in the same search result table?

sfatnass
Contributor

Hi,

I want to know if it's possible to get rare and top value on the same table search.

index=_internal |top limit=5 sourcetype
index=_internal |rare limit=5 sourcetype

thx

Tags (3)
0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

Hmm. Here is one way:

index=_internal
| top limit=2 sourcetype
| append [ search index=_internal | rare limit=2 sourcetype ]

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

Hmm. Here is one way:

index=_internal
| top limit=2 sourcetype
| append [ search index=_internal | rare limit=2 sourcetype ]

View solution in original post

sfatnass
Contributor

thx aljhonson

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

np @sfatnass

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.