Splunk Search

First x results by host.

marquiselee
Path Finder

I want to get the first(most recent) say 10 results that meet my criteria per host. Because my environment has 100s of hosts, some of which are way more active than others... I need a way to keep splunk from searching for matches on the hosts where I've already matched the 10 results I'm seeking.

I'd imagine it would look something like this...

index=main sourcetype=ingest_logs status=error | head 10 by host | table _time host _raw

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

"by host" is not valid for the head command. Just 'head 10' should do the job.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Are you looking for something like this
host1 firstrecord...
host1 secondrecord..
.......
.......
host1 tenthrecord
host2 firstrecord...
host2 secondrecord..
.......
.......
host2 tenthrecord
....

0 Karma

richgalloway
SplunkTrust
SplunkTrust

"by host" is not valid for the head command. Just 'head 10' should do the job.

---
If this reply helps you, Karma would be appreciated.
0 Karma

linu1988
Champion

its not possible if you don't have a reference. you can make a outputcsv host.csv. then in the next search

index=main sourcetype=ingest_logs status=error host NOT [|inputcsv host.csv]| head 10 by host | table _time host _raw

something like this...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...