topic Re: Splunk Head command in Splunk Search

Splunk Head command

SplunkSN — Mon, 23 Oct 2023 16:53:24 GMT

Hi All,

Splunk "head" command by default retrieves top 10 columns and 10 results. may i know if we can control the number of columns to be retrieved.

index= <Splunk query>| timechart span=15m count by dest_domain usenull=f useother=f | head 15

e.g.

_time|column1|...............................................................|coulmn15
1

Re: Splunk Head command

richgalloway — Mon, 23 Oct 2023 17:02:25 GMT

To be pedantic, Splunk doesn't have "columns" in the DBA sense. We call them "fields".

The head command returns all fields in the first n results. The fields to return can be controlled with the fields command.

index= <Splunk query> | fields _time column1 column2 ... column15 | timechart span=15m count by dest_domain usenull=f useother=f | head 15

In this case, however, head is unnecessary because timechart can do the same thing.

index= <Splunk query> | fields _time column1 column2 ... column15 | timechart limit=15 span=15m count by dest_domain usenull=f useother=f

Re: Splunk Head command

_JP — Mon, 23 Oct 2023 17:31:54 GMT

Are you interested in leaving out dest_domain values that don't have high counts? A real simple way to approach it is to "pre-count" the dest_domain using eventstats, and limit just those that had more than a particular threshold (in this case 100) with the where command:

index= <Splunk query> | eventstats count by sourcetype | where count>100 | timechart span=15m count by dest_domain usenull=f useother=f | head 15

Also, when you think about how Splunk is running these commands, you might visualize it running these commands over and over your data...like several for-loops one right after another. That's what it does. That's what it is optimized for...it's a bit counterintuitive compared to databases where you are trying to limit full-scans of things. The distributed architecture of Splunk is built for this.

Re: Splunk Head command

bowesmana — Tue, 24 Oct 2023 08:09:11 GMT

@SplunkSN as @richgalloway says, the head command does not limit the columns/fields retrieved, it simply takes the first n results, so in your timechart case, it will return the earliest 15 rows of your timechart, so effectively 15 rows of 15 minute spans.

if you want to control the highest count of the dest_domain, you can use a where clause in the timechart, like this

| timechart span=15m count by dest_domain usenull=f useother=f where count in top10

which will show you the 10 dest_domain values that have the highest count.