Splunk Core Certified User — Question 177

Which of the following is a correct way to limit search results to display the 5 most common values of a field?

Answer options

• A. | rare top=5
• B. | top rare=5
• C. | top limit=5
• D. | rare limit=5

Correct answer: C

Explanation

The correct answer is C, as '| top limit=5' accurately specifies that you want to retrieve the top 5 values. Options A and D incorrectly use 'rare', which is not intended for limiting common values, while option B misplaces 'rare' before 'top', making it invalid for this context.