https://community.splunk.com/t5/Splunk-Search/Search-first-10-results-by-sourcetype/m-p/159537#M45037 <P>You need to specify a field for the top command, maybe you wanted this:</P> <P>|top limit=10 _raw by sourcetype</P> Wed, 25 Feb 2015 15:17:25 GMT gfuente 2015-02-25T15:17:25Z https://community.splunk.com/t5/Splunk-Search/Search-first-10-results-by-sourcetype/m-p/159535#M45035 <P>Hello I have question regarding limiting the number of events on search to reduce the search time.</P> <P>Currently, I'm trying to get summary of sourcetype for their eps(events per sec) and log stoppage.</P> <P>Here is the query I'm using currently.</P> <PRE><CODE>sourcetype=firewall:web1|head 10|stats sparkline count, first(_time) AS LastTime last(_time) as FirstTime values(index) AS Index values(sourcetype) AS SourceType |eval timediff=now()-LastTime|eval duration=LastTime-FirstTime|eval eps=10/duration|fields Index SourceType FirstTime sparkline LastTime duration eps timediff|convert ctime(FirstTime) ctime(LastTime) </CODE></PRE> <P>Above query gives me the details of the logging activity and I have tried to reduce search time by applying <CODE>|head 10</CODE><BR /> The problem is that I have dozens of sourcetype and would like to get the summary for all the sourcetype I have.<BR /> However, as I used sourceytpe=*, I can only get first few sourcetype because I have limited search for the first 10 events, not for 10 events per sourcetype. <BR /> Is there a way to limit number of events on search by fields such as index or sourcetype?<BR /> I've made dashboard with a table applying above query for each sourcetype (one table per sourcetype) but it's taking forever. <BR /> Any suggestion?</P> Wed, 25 Feb 2015 14:19:28 GMT https://community.splunk.com/t5/Splunk-Search/Search-first-10-results-by-sourcetype/m-p/159535#M45035 hcheang 2015-02-25T14:19:28Z https://community.splunk.com/t5/Splunk-Search/Search-first-10-results-by-sourcetype/m-p/159536#M45036 <P>Can you use <EM>top</EM> instead of <EM>head</EM> like:</P> <PRE><CODE>...|top limit=10 by sourcetype|... </CODE></PRE> Wed, 25 Feb 2015 15:10:17 GMT https://community.splunk.com/t5/Splunk-Search/Search-first-10-results-by-sourcetype/m-p/159536#M45036 sanjay_shrestha 2015-02-25T15:10:17Z https://community.splunk.com/t5/Splunk-Search/Search-first-10-results-by-sourcetype/m-p/159537#M45037 <P>You need to specify a field for the top command, maybe you wanted this:</P> <P>|top limit=10 _raw by sourcetype</P> Wed, 25 Feb 2015 15:17:25 GMT https://community.splunk.com/t5/Splunk-Search/Search-first-10-results-by-sourcetype/m-p/159537#M45037 gfuente 2015-02-25T15:17:25Z https://community.splunk.com/t5/Splunk-Search/Search-first-10-results-by-sourcetype/m-p/159538#M45038 <P>Actually I found easier way!.</P> <P>I tried dedup 10 sourcetype and it worked like magic.</P> <P>Thanks for the answers, too!</P> Thu, 26 Feb 2015 12:47:38 GMT https://community.splunk.com/t5/Splunk-Search/Search-first-10-results-by-sourcetype/m-p/159538#M45038 hcheang 2015-02-26T12:47:38Z