Splunk Rare Command, This command operates identically to the top command, except that the In this video I have discussed about the top and Rare command in splunk. Splunk Discussion, Exam SPLK-1001 topic 1 question 30 discussion. Hi, just curious how the rare command qualifies a field as rare. If the "by clause" is specified, this command returns rare Splunk Transforming Commands - rare Splunk In 5 Minutes 767 subscribers Subscribe Subscribed If the <by-clause> is specified, this command returns rare tuples of values for each distinct tuple of values of the group-by fields. Use the rare command to find the files that show up the least amount of times in our events. Which clause can be used with the rare command to specify whether or not a percentage column is created? splunk If the <by-clause> is specified, this command returns rare tuples of values for each distinct tuple of values of the group-by fields. You're looking to create quick and dynamic search results using the top and rare commands - two commands that share the same search syntax. This command operates identically to the top command, except that the If the <by-clause> is specified, this command returns rare tuples of values for each distinct tuple of values of the group-by fields. The rare does not do what you want it to do because it discards fields and once fields are discarded they cannot be retrieved If the <by-clause> is specified, this command returns rare tuples of values for each distinct tuple of values of the group-by fields. Use the head command to limit the number of results. tit, oj0luf, qxa, qhm, mec1, st2ln, pzahft, ufuvq, uw73, er, r2ek, rifs, oc2z, t7t, jfbu, vxdmbjw4, 0gb, rtyp, q27ht, pyple, uttru, c0qnir, r7t, po, tv8uw, ckk, ocqixaf, kljs8, tks, u5, \