Splunk Search

Is it possible to get both rare and top results in the same search result table?

sfatnass
Contributor

Hi,

I want to know if it's possible to get rare and top value on the same table search.

index=_internal |top limit=5 sourcetype
index=_internal |rare limit=5 sourcetype

thx

Tags (3)
0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

Hmm. Here is one way:

index=_internal
| top limit=2 sourcetype
| append [ search index=_internal | rare limit=2 sourcetype ]

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

Hmm. Here is one way:

index=_internal
| top limit=2 sourcetype
| append [ search index=_internal | rare limit=2 sourcetype ]

View solution in original post

sfatnass
Contributor

thx aljhonson

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

np @sfatnass

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!