https://community.splunk.com/t5/Splunk-Search/Trying-to-get-the-first-10-events-based-on-sourcetype/m-p/134978#M36890 <P>Outstanding! thanks much.</P> Fri, 18 Apr 2014 00:02:58 GMT Runals 2014-04-18T00:02:58Z https://community.splunk.com/t5/Splunk-Search/Trying-to-get-the-first-10-events-based-on-sourcetype/m-p/134976#M36888 <P>I'm trying to get the first 10 or so events per sourcetype but the methodology is escaping me. You can't simply use the head command. I also am wanting all fields in the event so can't do something like | top 10 by sourcetype as that doesn't specify any fields. Any thoughts?</P> Thu, 17 Apr 2014 12:41:50 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-get-the-first-10-events-based-on-sourcetype/m-p/134976#M36888 Runals 2014-04-17T12:41:50Z https://community.splunk.com/t5/Splunk-Search/Trying-to-get-the-first-10-events-based-on-sourcetype/m-p/134977#M36889 <P>You can use the dedup command to only keep 10 of each sourcetype, returning the full events:</P> <PRE><CODE>* | dedup 10 sourcetype </CODE></PRE> Thu, 17 Apr 2014 14:25:01 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-get-the-first-10-events-based-on-sourcetype/m-p/134977#M36889 kaufmanm 2014-04-17T14:25:01Z https://community.splunk.com/t5/Splunk-Search/Trying-to-get-the-first-10-events-based-on-sourcetype/m-p/134978#M36890 <P>Outstanding! thanks much.</P> Fri, 18 Apr 2014 00:02:58 GMT https://community.splunk.com/t5/Splunk-Search/Trying-to-get-the-first-10-events-based-on-sourcetype/m-p/134978#M36890 Runals 2014-04-18T00:02:58Z