https://community.splunk.com/t5/Splunk-Search/First-x-results-by-host/m-p/149775#M41914 <P>its not possible if you don't have a reference. you can make a outputcsv host.csv. then in the next search </P> <P>index=main sourcetype=ingest_logs status=error host NOT [|inputcsv host.csv]| head 10 by host | table _time host _raw</P> <P>something like this...</P> Wed, 20 Nov 2013 17:42:11 GMT linu1988 2013-11-20T17:42:11Z https://community.splunk.com/t5/Splunk-Search/First-x-results-by-host/m-p/149774#M41913 <P>I want to get the first(most recent) say 10 results that meet my criteria per host. Because my environment has 100s of hosts, some of which are way more active than others... I need a way to keep splunk from searching for matches on the hosts where I've already matched the 10 results I'm seeking. </P> <P>I'd imagine it would look something like this...</P> <P>index=main sourcetype=ingest_logs status=error | head 10 by host | table _time host _raw</P> Wed, 20 Nov 2013 16:13:21 GMT https://community.splunk.com/t5/Splunk-Search/First-x-results-by-host/m-p/149774#M41913 marquiselee 2013-11-20T16:13:21Z https://community.splunk.com/t5/Splunk-Search/First-x-results-by-host/m-p/149775#M41914 <P>its not possible if you don't have a reference. you can make a outputcsv host.csv. then in the next search </P> <P>index=main sourcetype=ingest_logs status=error host NOT [|inputcsv host.csv]| head 10 by host | table _time host _raw</P> <P>something like this...</P> Wed, 20 Nov 2013 17:42:11 GMT https://community.splunk.com/t5/Splunk-Search/First-x-results-by-host/m-p/149775#M41914 linu1988 2013-11-20T17:42:11Z https://community.splunk.com/t5/Splunk-Search/First-x-results-by-host/m-p/149776#M41915 <P>"by host" is not valid for the head command. Just <CODE>'head 10'</CODE> should do the job.</P> Wed, 20 Nov 2013 17:47:06 GMT https://community.splunk.com/t5/Splunk-Search/First-x-results-by-host/m-p/149776#M41915 richgalloway 2013-11-20T17:47:06Z https://community.splunk.com/t5/Splunk-Search/First-x-results-by-host/m-p/149777#M41916 <P>Are you looking for something like this<BR /> host1 firstrecord...<BR /> host1 secondrecord..<BR /> .......<BR /> .......<BR /> host1 tenthrecord<BR /> host2 firstrecord...<BR /> host2 secondrecord..<BR /> .......<BR /> .......<BR /> host2 tenthrecord<BR /> ....</P> Wed, 20 Nov 2013 18:23:49 GMT https://community.splunk.com/t5/Splunk-Search/First-x-results-by-host/m-p/149777#M41916 somesoni2 2013-11-20T18:23:49Z