Splunk Search

Is it possible to get both rare and top results in the same search result table?

sfatnass
Contributor

Hi,

I want to know if it's possible to get rare and top value on the same table search.

index=_internal |top limit=5 sourcetype
index=_internal |rare limit=5 sourcetype

thx

Tags (3)
0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

Hmm. Here is one way:

index=_internal
| top limit=2 sourcetype
| append [ search index=_internal | rare limit=2 sourcetype ]

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

Hmm. Here is one way:

index=_internal
| top limit=2 sourcetype
| append [ search index=_internal | rare limit=2 sourcetype ]

sfatnass
Contributor

thx aljhonson

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

np @sfatnass

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...