Q: 3
Select this in the fields sidebar to automatically pipe you search results to the rare command
Options
Discussion
B. It's 'rare values' in the sidebar that'll trigger the rare command, pretty sure about that. D does top, not rare. Disagree?
Nah, not D. Pretty sure it's B since 'rare values' in the fields sidebar actually runs the rare command automatically. D is a common trap because 'top values' uses the top command, not rare. Anyone have a different take?
Maybe D, I've seen similar options in the Splunk practice labs and 'top values' comes up a lot. Would double check in the official user guide or hands-on search panel though.
B, not D. 'Top values' is a distractor, only 'rare values' pipes to the rare command here.
Be respectful. No spam.