Exam objective 3.6 for the Splunk Core Certified User exam asks you to use specific commands to turn raw event data into meaningful summaries. This chapter teaches you four essential statistical commands — top, rare, chart, and timechart — that transform a mountain of entries into clear answers about what is common, what is unusual, and how things change over time.
Jump to a section
A simple way to picture Other Statistical Commands (top, rare, chart, timechart)
A coffee shop manager's end-of-day report is a perfect analogy for Splunk's statistical commands. The report's central object is a stack of completed order slips, each recording what a customer bought and when. This stack is like the raw data Splunk searches.
To summarise the day, the manager uses different views. First, the manager asks 'Which drink was ordered most today?' This is the 'top' command — it counts every order slip, groups them by drink type (latte, cappuccino, tea), and then lists them from most frequent to least. The top result might be 'Latte — 87 orders'. Conversely, the manager might ask 'Which drink almost nobody ordered?' This is the 'rare' command — it does the same counting but reverses the list, putting the least-ordered item first, like 'Chai latte — 2 orders', exposing unpopular items that might be removed from the menu.
The manager then needs a clearer picture of sales across product categories. Instead of a simple ranked list, the manager creates a 'chart' — a table with coffee types down the side and pastry types across the top, with counts in each cell. This shows, for example, that lattes sell well with croissants but not with muffins. Finally, the manager wants to spot trends over time. A 'timechart' is a line graph showing coffee sales per hour. It reveals the 8 AM rush for espressos and the 2 PM lull. Each of these commands takes the same pile of order slips and transforms them into a different, actionable summary, exactly as Splunk transforms machine data into business insight.
Splunk ingests machine data as individual events. An event is a single record, like one log entry from a web server or one error from a firewall. When you search for 'error', Splunk might return thousands of events. Reading them one by one is impractical. Statistical commands summarise these events into counts, percentages, and visual tables. This section explains four foundational commands: top, rare, chart, and timechart.
The 'top' command finds the most common values in a field. A field is a named piece of information extracted from an event, like 'status_code' or 'user_agent'. The syntax is simple: ... | top FIELD_NAME. Splunk counts how many events exist for each unique value of that field, then sorts the results from highest count to lowest. By default, 'top' shows the ten most common values, but you can change that limit with the 'limit' keyword. For example, ... | top limit=5 user_agent shows the five most frequently used web browsers in your log data. The output includes a column for count and a column for percent, showing the proportion of total events each value represents. This command is useful for identifying the most frequent source IPs, the most common error codes, or the most visited web pages.
The 'rare' command is the opposite of 'top'. It finds the least common values in a field. The syntax is ... | rare FIELD_NAME. 'Rare' counts events per unique value, then sorts from lowest count to highest. By default, it also shows ten values. This is helpful for finding outlier events, such as a single unusual error code, a rarely used network protocol, or a user who only accessed the system once. 'Rare' helps security analysts spot potentially malicious, isolated events.
The 'chart' command is more powerful: it creates a table from your search results. Unlike 'top' and 'rare', which work on a single field, 'chart' can split your data by two dimensions. The basic syntax is ... | chart VALUES BY X OVER Y. The 'VALUES' part is the numeric function you apply, like 'count', 'sum', or 'average'. The 'X' field becomes the column labels. The 'Y' field becomes the row labels. For example, ... | chart count BY host OVER status creates a table where each row is a host (server name), each column is a status code (200, 404, 500), and each cell is the count of events for that host with that status. If you only need one dimension, you can write ... | chart count BY host. This still creates a table, but with two columns: host and count. 'Chart' is a versatile tool for comparing values across categories.
The 'timechart' command specialises in time-based data. It automatically splits results into time buckets and applies a statistical function to each bucket. The syntax is ... | timechart count BY FIELD_NAME. For example, ... | timechart count BY status creates a line chart where each line represents a different status code, and the x-axis is time. Splunk chooses sensible time spans (like 5 minutes for a 1-hour search) but you can override this with the 'span' argument: ... | timechart span=1h count BY status. Timechart always puts time on the x-axis, making it the default tool for trend analysis, seasonality detection, and monitoring changes over hours, days, or weeks.
All four commands share a common trait: they aggregate data. Aggregation means combining multiple events into a single summary value. Without these commands, you would have to manually count events. They save time and reveal patterns invisible in raw data. In exam terms, you must know the basic syntax and the output format of each command, as well as when to use one versus the other.
Start with a base search
Every statistical command needs data to work with. Begin by writing a search that returns the relevant events. For example, 'index=web sourcetype=access_combined status=503' returns all '503' errors. This step filters the data so your summary is meaningful.
Apply the 'top' command to find common values
If you want to know which fields appear most frequently, pipe your search into 'top FIELD_NAME'. For example, '... | top uri_path'. This command counts occurrences of each unique URI path and lists them from most to least common. The output includes 'count' and 'percent' columns, which help you quickly spot the biggest problems.
Apply the 'rare' command to find unusual values
If you are looking for anomalies, replace 'top' with 'rare'. For example, '... | rare clientip'. This lists the least frequently occurring IP addresses. This step is useful for security investigations to find IPs that visited only once.
Build a cross-comparison table with 'chart'
To compare two fields, use 'chart count BY field1 OVER field2'. For example, '... | chart count BY host OVER status'. This creates a table where each row is a server, each column is a status code, and each cell is the count. This step reveals which servers produce which status codes, enabling targeted troubleshooting.
Visualise trends over time with 'timechart'
If you need to see how a metric changes over time, use 'timechart'. For example, '... | timechart count BY status span=5m'. This creates a line chart with time on the x-axis. This step is critical for detecting patterns like recurring errors, usage spikes, or gradual degradation.
Refine with 'limit' and 'span'
Adjust the output to suit your needs. Use 'limit' with 'top' or 'rare' to show more or fewer results. Use 'span' with 'timechart' to change the time bucket size. This final step ensures your summary is not too cluttered or too vague.
An IT operations team manages a large e-commerce website. They use Splunk to monitor user activity and server health. One morning, users start reporting slow page loads. The team launches Splunk to investigate.
First, they run a search for recent web server logs. They use the 'top' command to quickly identify the most common HTTP status codes over the last hour. The command is index=web sourcetype=access_combined | top status. The output shows '200' (success) as the vast majority, but '503' (service unavailable) appears in the top five. This tells them the website is returning '503' errors more than usual.
Next, they want to see which specific pages are failing. They drill down by running index=web sourcetype=access_combined status=503 | top uri_path. This shows the product checkout page as the top URI returning errors. Now they have a suspect: the checkout service.
To understand the pattern, they use the 'chart' command to compare error counts across different web servers. They run index=web sourcetype=access_combined status=503 | chart count BY host over uri_path. This table has server hostnames as rows and checkout, login, and homepage as columns. They see that 'server-web-03' has 150 errors on the checkout page, while the other servers have fewer than 10. This points to a specific server problem, not a global issue.
The team suspects the checkout service is crashing and restarting repeatedly. To verify, they use 'timechart' to see the frequency of 503 errors over time. They run index=web sourcetype=access_combined status=503 | timechart count BY host span=5m. The resulting chart shows a spiky pattern for server-web-03 — spikes of errors every 10 minutes — exactly the pattern of a service repeatedly crashing and restarting.
The operations team now has clear evidence. They escalate the issue to the DevOps team, who connect to server-web-03 and find a memory leak in the checkout microservice. The team rolls back a recent code deployment, and the error count drops to zero. Within an hour, the website is fast again.
This scenario demonstrates how an IT professional moves from a vague problem ('site is slow') to a precise root cause (server-web-03, checkout page, memory leak) using Splunk's statistical commands in sequence. Without 'top', they would not know which status code to focus on. Without 'chart', they could not isolate the faulty server. Without 'timechart', they could not recognise the crash-restart pattern. Each command provides a specific view of the same data, and using them together solves problems efficiently.
The SPLK-1002 exam tests your ability to select the correct statistical command for a given scenario. The questions are not tricky — they are direct — but you must know the differences. Here is exactly what the exam focuses on:
Questions on 'top' and 'rare' are the most straightforward. The exam gives you a scenario: 'Which command finds the least frequent values?' The answer is 'rare'. Another common question: 'By default, how many values does the top command return?' The answer is '10'. They also test the 'limit' keyword: 'Which keyword changes the number of results shown by top?' Answer: 'limit'. You must know that 'top' and 'rare' work on a single field and return a table with count and percent columns.
Questions on 'chart' and 'timechart' require more careful reading. The exam loves to test whether you can identify which command places time on the x-axis. The answer is 'timechart'. They also test the 'span' argument: 'Which argument sets the time interval in timechart?' Answer: 'span'. A common trap is a question that asks for a table comparing two fields but does not mention time. The correct answer is 'chart', not 'timechart', because timechart always uses time. Another trap: a question says 'show the most common error over the last week.' The best command is 'top', but some beginners pick 'chart' because they think they need a table. Remember: 'top' is for ranking by frequency; 'chart' is for cross-tabulation.
The exam also tests the default sort order. For 'top', it is descending (highest to lowest). For 'rare', it is ascending (lowest to highest). They may ask: 'What is the default sort direction for the top command?' The answer is 'descending'. If they ask 'What is the default limit for timechart?', the answer is '10' — that is a trick, because timechart has no default limit; it returns all time buckets. The default limit of 10 only applies to 'top' and 'rare'. Do not confuse them.
The exam includes questions about combining these commands with other commands, like 'search' or 'eval'. For instance, they might ask: 'Which command comes before top in the search pipeline?' The answer is 'search', because you filter events before summarising. They might ask: 'Which command converts a field to uppercase before using chart?' The answer is 'eval'. These are not tricky, but you must remember the order of operations.
A final key point: the exam tests the concept of 'BY' and 'OVER' in chart. For 'chart', the syntax is chart <aggregation> BY <row-split> OVER <column-split>. The field after 'BY' becomes the rows, and the field after 'OVER' becomes the columns. If you swap them, the table will be transposed. They may ask: 'In the command chart count BY host OVER status, what becomes the rows?' The answer is 'host'.
In summary, the exam tests:
The exact syntax of each command.
The default behaviours (limit of 10, sort order).
When to use 'chart' vs 'timechart' (time vs no time).
The role of 'limit' and 'span' keywords.
The 'BY' and 'OVER' split logic.
The traps are: confusing 'chart' with 'timechart', forgetting the default limit, and misreading the 'BY' and 'OVER' fields. Practise writing the commands until the syntax is automatic.
The 'top' command lists the most frequent values of a field, defaulting to ten results sorted from highest to lowest count.
The 'rare' command lists the least frequent values of a field, defaulting to ten results sorted from lowest to highest count.
The 'chart' command creates a two-dimensional table from your search results, splitting data by one field into rows and another field into columns.
The 'timechart' command creates a time-based chart, automatically placing time on the x-axis and splitting data into time buckets.
You can change the number of results for 'top' and 'rare' using the 'limit' keyword, such as 'top limit=5 user'.
You can set the time interval for 'timechart' using the 'span' keyword, such as 'timechart span=1h count BY status'.
All four commands are aggregation commands: they reduce many events into summary counts or percentages.
The 'chart' command requires at least one aggregation function (like 'count' or 'sum') and at least one field to split by.
These come up on the exam all the time. Here's how to tell them apart.
top
Shows most frequent values (descending order)
Default limit of 10 results
Use for identifying common patterns or bottlenecks
rare
Shows least frequent values (ascending order)
Default limit of 10 results
Use for identifying rare outliers or anomalies
chart
Does not require a time field
Creates a table with rows and columns
Use for comparing static categories
timechart
Always uses _time as x-axis
Creates a line chart with time buckets
Use for analysing trends over time
top
Output includes percentage column by default
Always sorted by count descending
Simpler syntax for one-field frequency analysis
chart count BY field
Output does not include percentage by default
Sort order is not guaranteed (usually descending)
More flexible for two-dimensional tables
timechart count BY field
Uses automatic default time span
Results may have too many or too few buckets
Good for quick trend glance
timechart span=1h count BY field
Uses a fixed 1-hour time interval
Results have exactly one bucket per hour
Good for consistent comparison across searches
Mistake
The 'top' command shows the top values 'for all time' across all data in Splunk.
Correct
The 'top' command only summarises the events returned by the preceding search, not the entire index. It is always filtered by the search before it.
Beginners think 'top' is a global command, but it is part of a search pipeline and operates on results, not raw data.
Mistake
The 'chart' command can replace 'top' because it also counts events by category.
Correct
While 'chart' can count events, it is designed for two-dimensional tables. Using 'chart count BY field' is valid, but 'top' is simpler and includes percentage columns by default.
Learners see overlapping functionality and assume 'chart' is always better, missing the default formatting and simplicity of 'top'.
Mistake
The 'rare' command returns the same results as 'top' but just reversed.
Correct
Although 'rare' sorts in ascending order, it also respects a default limit of 10. However, the values returned are not simply the reverse of 'top' because they are the least frequent, which might include values that 'top' excludes entirely.
Superficially, reversing 'top' seems logical, but 'rare' is intended for outliers and may return values not shown by 'top' at all.
Mistake
The 'timechart' command always uses a 5-minute time span.
Correct
The default time span is automatically determined by the search time range, not fixed at 5 minutes. It adapts to provide a manageable number of data points.
Beginners might see a specific example with a 5-minute span and assume it is universal, but Splunk adjusts the span dynamically.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
'Chart' creates a table from any two fields, with no requirement for time. 'Timechart' always places time on the x-axis and automatically splits the results into time intervals. Use 'chart' for static comparisons and 'timechart' for trend analysis over time.
Yes, the 'top' command includes a 'percent' column by default, showing the percentage of total events that each value represents. You can suppress this using the 'showperc=false' argument.
Use the 'limit' keyword. For example, 'top limit=20 field' shows the 20 most common values. The default limit is 10. If you set limit=0, it shows all values.
The 'span' argument sets the time interval for each bucket on the x-axis. For example, 'span=1h' creates one data point per hour. If you do not specify 'span', Splunk automatically chooses an interval based on your search time range.
Yes, you can use 'chart count BY field' to create a simple two-column table (field name and count). This is similar to 'top' but without the percentage column and with different default formatting.
If you use 'timechart count BY field' and the field has many unique values, you get many lines. Use 'limit' within the timechart command to show only the top values, or pre-filter your data with 'top' before sending it to 'timechart'.
Use the 'rare' command. For example, 'index=web | rare http_method'. This will list HTTP methods from least to most frequent, putting the rarest method at the top.
You've finished Other Statistical Commands (top, rare, chart, timechart). Continue through the SPLK-1002 study guide to build a complete picture of the exam.
Done with this chapter?