rare Сommand in Splunk

[post-views]
December 30, 2024 · 1 min read
rare Сommand in Splunk

The rare command in Splunk helps you find the least common values in a specific field of your data. This is useful for spotting unusual or infrequent events. By default, the rare command in Splunk returns the 10 least common values for a specified field.

Find Rare User Agents

To identify the least common user agents in your web access logs:

index=web sourcetype=access_logs | rare user_agent

This returns 10 of the least common user agents.

Identify Uncommon HTTP Status Codes

To detect rare HTTP status codes in your security logs:
Here we set the limit of returns using limit

index=security sourcetype=security_logs | rare http_status_code limit=3

This returns the 3 least common HTTP status codes, helping to spot unusual responses.

Table of Contents

Was this article helpful?

Like and share it with your peers.
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
Join for Free Book a Meeting

Related Posts

Search and Replace Text in SPL Fields with rex
Blog, Knowledge Bits — 1 min read
Search and Replace Text in SPL Fields with rex
John Stevens
coalesce Function in Splunk
Blog, Knowledge Bits — 1 min read
coalesce Function in Splunk
Justin Erb
Using map Command in Splunk
Blog, Knowledge Bits — 3 min read
Using map Command in Splunk
Alex Verbniak