Which search will return the 15 least common field values for the dest_ip field?
A) sourcetype=firewall | rare num=15 dest_ip
B) sourcetype=firewall | rare last=15 dest_ip
C) sourcetype=firewall | rare count=15 dest_ip
D) sourcetype=firewall | rare limit=15 dest_ip

Question

Quizplus · Accepted Answer

The "rare" command in Splunk is used to find the least common values, and the correct syntax to limit the number of results is "limit=15".

Which Search Will Return the 15 Least Common Field Values