https://community.splunk.com/t5/Splunk-Search/Expanding-data-within-my-eval-search/m-p/632028#M219533 <P>Try something like this</P><LI-CODE lang="markup">index=data severity IN ("critical","high","medium","low") | eval TopHost = split([ search index=tenable severity IN ("critical","high","medium","low") | where len(dnsName)&gt;0 | dedup dnsName,solution | dedup dnsName,pluginText | rex field=pluginName "^(?&lt;VulnName&gt;(?:\w+\s+){2})" | dedup dnsName,VulnName | top limit=1 dnsName | rename dnsName as query | fields query | head 5 | format "\"" "" "" "" "" "\""]," ") | where dnsName=TopHost | table dnsName, ip</LI-CODE><P>This assumes dnsName has no spaces in it</P> Thu, 23 Feb 2023 15:36:35 GMT ITWhisperer 2023-02-23T15:36:35Z https://community.splunk.com/t5/Splunk-Search/Expanding-data-within-my-eval-search/m-p/632022#M219529 <P>index=data severity IN ("critical","high","medium","low")<BR />| eval TopHost =<BR />[ search index=tenable severity IN ("critical","high","medium","low")<BR />| where len(dnsName)&gt;0<BR />| dedup dnsName,solution<BR />| dedup dnsName,pluginText<BR />| rex field=pluginName "^(?&lt;VulnName&gt;(?:\w+\s+){2})"<BR />| dedup dnsName,VulnName<BR />| top limit=1 dnsName<BR />| rename dnsName as query<BR />| fields query<BR />| head 1]</P><P><BR />| where dnsName=TopHost<BR />| table dnsName, ip</P><P>&nbsp;</P><P>My query above works, but missing one thing. Right now it is getting the first result ( using head command ). I am trying to do first 5 results and store that to my eval variable. I tried to change head 5 but got errors. Any help is appreciated.&nbsp;Thanks<BR /><BR /></P><P>Attached error<BR /><BR /></P> Thu, 23 Feb 2023 15:06:33 GMT https://community.splunk.com/t5/Splunk-Search/Expanding-data-within-my-eval-search/m-p/632022#M219529 AttarSingh1 2023-02-23T15:06:33Z https://community.splunk.com/t5/Splunk-Search/Expanding-data-within-my-eval-search/m-p/632028#M219533 <P>Try something like this</P><LI-CODE lang="markup">index=data severity IN ("critical","high","medium","low") | eval TopHost = split([ search index=tenable severity IN ("critical","high","medium","low") | where len(dnsName)&gt;0 | dedup dnsName,solution | dedup dnsName,pluginText | rex field=pluginName "^(?&lt;VulnName&gt;(?:\w+\s+){2})" | dedup dnsName,VulnName | top limit=1 dnsName | rename dnsName as query | fields query | head 5 | format "\"" "" "" "" "" "\""]," ") | where dnsName=TopHost | table dnsName, ip</LI-CODE><P>This assumes dnsName has no spaces in it</P> Thu, 23 Feb 2023 15:36:35 GMT https://community.splunk.com/t5/Splunk-Search/Expanding-data-within-my-eval-search/m-p/632028#M219533 ITWhisperer 2023-02-23T15:36:35Z