Splunk Cloud

Search Reference

Download manual as PDF

Download topic as PDF



Displays the least common values of a field.

Finds the least frequent tuple of values of all fields in the field list. If the <by-clause> is specified, this command returns rare tuples of values for each distinct tuple of values of the group-by fields.

This command operates identically to the top command, except that the rare command finds the least frequent instead of the most frequent.



Required arguments

Syntax: <string>,...
Description: Comma-delimited list of field names.

Optional arguments

Syntax: BY <field-list>

Top options

Syntax: countfield=<string>
Description: The name of a new field to write the value of count into.
Default: "count"
Syntax: limit=<int>
Description: Specifies how many tuples to return. If you specify limit=0, all values up to maxresultrows are returned. See Limits section. Specifying a value larger than maxresultrows produces an error.
Default: 10
Syntax: percentfield=<string>
Default: "percent"
Syntax: showcount=<bool>
Default: true
Syntax: showperc=<bool>
Default: true


The rare command is a transforming command. See Command types.

The number of results returned by the rare command is controlled by the limit argument. The default value for the limit argument is 10. You can change this limit up to the maximum value specified in the maxresultrows setting in the [rare] stanza in the limits.conf file. The default maximum is 50,000, which effectively keeps a ceiling on the memory that the rare command uses.


1. Return the least common values in a field

Return the least common values in the "url" field. Limits the number of values returned to 5.

... | rare url limit=5

2. Return the least common values organized by host

Find the least common values in the "user" field for each "host" value. By default, a maximum of 10 results are returned.

... | rare user by host

See also

top, stats, sirare


Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the rare command.


This documentation applies to the following versions of Splunk Cloud: 6.6.3, 7.0.0, 7.0.3, 7.0.5, 7.0.2, 7.0.8, 7.1.3, 7.1.6, 7.2.3, 7.2.4, 7.2.6


How do you define RARE what is the stats that decide how rare is rare

March 13, 2014

Thanks! It's been updated. ^_^

Sophy, Splunker
June 20, 2013

Under Top Options, you say limit= when it should be limit=. You also don't document rare= under Top Options.

March 22, 2011

Was this documentation topic helpful?





0 out of 1000 Characters