topic Get the 10 recent events for each host. in Splunk Search

Get the 10 recent events for each host.

allen_hunter — Wed, 28 Feb 2024 16:50:49 GMT

I am trying to write a search that will pull the 10 (or so) most recent events for each host. The tail and head commands apparently do not allow any grouping, and I am trying to wrap my head around how to do this.

I know this does not work, but this is what I am looking for:

index=index1
| head 10 by host

The closest I can come up with is:

 index=index1
| stats values(_raw) by host

But that still gives me everything in the time range, not just the last 10 events per host.

Re: Get the 10 recent events for each host.

allen_hunter — Wed, 28 Feb 2024 17:01:39 GMT

This seems to work, but feels a little "hack-ish":

index=txdir_mainframe 
| transaction host maxevents=20
| dedup host

If anyone has any better ideas, I am open to suggestions.

Thanks,

Re: Get the 10 recent events for each host.

richgalloway — Wed, 28 Feb 2024 17:58:59 GMT

There are couple of other ways to do that. I like the dedup command because it's simple. It retains the most recent n events by the specified field(s).

index = index1 | dedup 10 host

This method is for those who dislike dedup. It counts events by host and then takes those with a count <=10.

index = index1 | streamstats count by host | where count <= 10 | fields - count

Re: Get the 10 recent events for each host.

allen_hunter — Wed, 28 Feb 2024 19:57:04 GMT

I did not know you could add a count to the dedup statement. This is good info to know.

I completely forgot about trying the streamstats method. But I have used it in the past. Will put it in my notes for future reference.

Thanks!