ExamTopics Logo
Mail Us[email protected]
Menu
Splunk Discussions
exam questions

Exam SPLK-1001 All Questions

View all questions & answers for the SPLK-1001 exam
Go to Exam

Exam SPLK-1001 topic 1 question 30 discussion

Actual exam question from Splunk's SPLK-1001
Question #: 30
Topic #: 1
[All SPLK-1001 Questions]

What does the rare command do?

  • A. Returns the least common field values of a given field in the results.
  • B. Returns the most common field values of a given field in the results.
  • C. Returns the top 10 field values of a given field in the results.
  • D. Returns the lowest 10 field values of a given field in the results.
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️
Reference:
https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/Rare
by rakusu at March 4, 2021, 11:48 a.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
SimonR2
Highly Voted 1 year ago
I was trying to work out why this wasn't D, the wording is very subtle and the "lowest 10" bit caught me out. Basically, values of a field can be low, but that doesn't make them "uncommon". The value of a field can be the highest value in the dataset and still be considered "rare". So the answer is definitely A!
upvoted 5 times
...
HUGOTE
Most Recent 10 months, 2 weeks ago
A is correct
upvoted 3 times
...
Janna05
1 year, 9 months ago
A is correct pag 119 The rare command returns the least common field values of a given field in the results
upvoted 3 times
...
rakusu
1 year, 9 months ago
WHY NOT D?
upvoted 1 times
SecurityPaul
1 year, 5 months ago
Probably because of the language used. The specific term "least common" is the answer they want.
upvoted 1 times
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel