https://community.splunk.com/t5/Splunk-Search/How-to-get-the-head-K-of-each-index-in-a-Splunk-search/m-p/113213#M29759 <P>If you need the 10 most recent events by index, you can do this:</P> <PRE><CODE>index=* | streamstats current=t count by index | where count&lt;=10 | stats list(_raw) by index </CODE></PRE> Fri, 10 Jul 2015 16:37:37 GMT woodcock 2015-07-10T16:37:37Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-head-K-of-each-index-in-a-Splunk-search/m-p/113211#M29757 <P>My stats contain an entry called "index". How to get the head K of each index type? For example I want the top 10 in index=a, plus the top 10 in index=b, etc. </P> Fri, 10 Jul 2015 16:20:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-head-K-of-each-index-in-a-Splunk-search/m-p/113211#M29757 lys1030 2015-07-10T16:20:45Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-head-K-of-each-index-in-a-Splunk-search/m-p/113212#M29758 <P>You need a thing to "top" by. For example, to see the top sourcetypes by index, do this:</P> <PRE><CODE>index=* | top sourcetype by index </CODE></PRE> Fri, 10 Jul 2015 16:36:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-head-K-of-each-index-in-a-Splunk-search/m-p/113212#M29758 woodcock 2015-07-10T16:36:16Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-head-K-of-each-index-in-a-Splunk-search/m-p/113213#M29759 <P>If you need the 10 most recent events by index, you can do this:</P> <PRE><CODE>index=* | streamstats current=t count by index | where count&lt;=10 | stats list(_raw) by index </CODE></PRE> Fri, 10 Jul 2015 16:37:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-head-K-of-each-index-in-a-Splunk-search/m-p/113213#M29759 woodcock 2015-07-10T16:37:37Z