6.2 The rare Command

Splunk Core Certified User Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts & Logistics 1.2 Study Strategy & Learning Path

2 Splunk Basics

2.1 Splunk Components 2.2 Uses of Splunk 2.3 Splunk Apps 2.4 User Settings & Basic Navigation

3 Basic Searching

3.1 Running Basic Searches 3.2 Setting Time Ranges 3.3 Contents of Search Results 3.4 Refining Searches 3.5 Using the Timeline 3.6 Working with Events 3.7 Controlling Search Jobs 3.8 Saving Search Results

4 Using Fields in Searches

4.1 Understanding Fields 4.2 Using Fields in Searches 4.3 The Fields Sidebar

5 Search Language Fundamentals

5.1 Basic Search Commands & Practices 5.2 The Search Pipeline 5.3 Specifying Indexes in Searches 5.4 table, rename, fields, dedup, and sort

6 Using Basic Transforming Commands

6.1 The top Command 6.2 The rare Command 6.3 The stats Command

7 Creating Reports and Dashboards

7.1 Saving and Editing Reports 7.2 Statistical Table Reports 7.3 Chart Visualization Reports 7.4 Creating Dashboards and Adding Reports 7.5 Editing Dashboards

8 Creating and Using Lookups

8.1 Lookup Concepts and File Examples 8.2 Creating Lookup Files and Definitions 8.3 Configuring Automatic Lookups 8.4 Using Lookups in Searches

9 Creating Scheduled Reports and Alerts

9.1 Scheduled Reports 9.2 Describing and Creating Alerts 9.3 Viewing Fired Alerts

6.2 The rare Command

Key Takeaways Explain This Topic AI

rare is the inverse of top: same options and defaults, but it returns the least frequent field values.

Default limit is 10; count and percent appear by default just as they do for top.

Use rare for uncommon errors, unusual users, sparse status codes, or outlier combinations.

rare is still transforming—results appear as a Statistics table, not a long Events list.

Do not use rare when you need sums, averages, or distinct counts—those belong to stats.

Last updated: August 2026

6.2 The rare Command

Quick Answer: | rare <field> finds the least common values of a field. It uses the same options as top (default limit=10 , plus count and percent ). Choose rare when the exam question is about uncommon or outlier values—not averages or most-frequent rankings.

Topic 5.2 The rare command sits beside top in Domain 5.0 (15%) . Splunk’s own reference states that rare operates identically to top , except it returns the least frequent values instead of the most frequent. If you already understand top , rare is mostly a direction flip —but the exam still tests whether you pick the right direction.

Why uncommon values matter

Operations and security workflows often care about rarity :

• Status codes that almost never appear may signal a new failure mode
• Usernames that show up once may be misconfigurations or probing
• Hosts that barely send a sourcetype may be offline or mis-forwarding
• Method/URI pairs seen once may be exploratory attacks or broken clients

top answers “what dominates?” rare answers “what barely shows up?” Both are frequency tools; neither replaces stats for sums and averages.

• Syntax (same family as top) ... | rare [<options>] <field-list> [BY <field-list>]
• Example: index=web sourcetype=access_combined
• | rare status

You get the least common status values (default ten), each with count and percent .

• Shared with top Behavior for rare
• limit=<int> How many rarest tuples to keep (default 10 )
• showcount / showperc Toggle count/percent columns (default on)
• countfield / percentfield Rename those columns
• Multiple fields in the field list Rank rare combinations
• BY clause Rarest values per group index=security
• | rare limit=20 user BY action

This returns, for each action , up to twenty least common user values among events that reached the command.

Comparing top and rare side by side

• Question the user asks Command
• Which referers drive most traffic? top referer
• Which referers appear almost never? rare referer
• Top 5 error codes overall top limit=5 status (often after filtering to errors)
• Five scarcest error codes rare limit=5 status
• Per-host scarcest URIs rare uri_path BY host

Exam wording cues:

• most / common / frequent / popular / busiest → lean top
• least / rare / uncommon / infrequent / unusual → lean rare
• average / sum / distinct / min / max → lean stats
• Worked troubleshooting scenarios
• Scenario A — sparse HTTP statuses index=web earliest=-7d
• | rare limit=15 status

If almost all traffic is 200 / 304 , rare surfaces odd codes ( 418 , 451 , custom app codes) that top would bury beneath the popular ones.

• Scenario B — uncommon users failing login index=auth action=failure
• | rare limit=10 user

Here “rare” among failures means users who failed infrequently in the filtered set—useful when you already scoped to failures and want sparse usernames, not the noisiest attackers ( top user would show those).

• Scenario C — rare combinations index=web
• | rare limit=5 method, status

A combination like DELETE + 500 may be rarer (and more interesting) than either field alone.

Result shape and UI expectations

Like top , rare is a transforming command :

• Primary readable output is a Statistics table
• Default columns include the field(s) you named plus count and percent
• Percent is still relative to events that entered rare , after prior filters

Expectation Correct?

• rare returns least frequent values Yes
• Default returns 10 rows (unless limit changes) Yes
• You still get count and percent by default Yes
• rare is the command for average response time No — use stats avg(...)

After rare , Events tab shows the original millions of raw rows as the main answer No — you are looking at aggregated rare-value stats

Briefly: charting those rare-value tables comes later when you save reports/visualizations. Domain 5.2 tests that you can produce the rare-value table , not design a dashboard.

Limits and “all rare values”

limit=0 on this command family asks Splunk to return all qualifying tuples up to the configured maximum (documented ceiling tied to maxresultrows / limits settings). On the User exam, you rarely configure limits.conf ; just know:

• Default presentation is 10
• You can raise or lower with limit=

Extremely large limits are a memory/performance concern in real life—even if the exam only asks what the option does

Common traps

Picking rare when the stem says “most common.” Mirror-image mistakes are frequent on multiple-choice exams.

Thinking rare means “events with rare=true.” There is no such default field; rare is a command .

Using rare instead of a filter. If you only want status=500 , filter first ( status=500 ). rare ranks uncommon values; it does not mean “only error events.”

Forgetting BY scope. | rare user BY host is not the same as a global | rare user .

Assuming rare values are always security incidents. Rarity is a signal, not a verdict—exam answers stay at the SPL behavior level.

• Decision tree for Domain 5.1–5.2
• Need frequency ranking of field values? → top or rare
• Most vs least? → choose direction
• Need a number of rows other than 10? → set limit
• Need per-category rankings? → add BY
• Need math beyond frequency (sum/avg/dc)? → leave this pair and use stats

Internalize that tree and 5.2 questions reduce to reading the adjective in the stem ( least vs most ) and matching options.