https://community.splunk.com/t5/Splunk-Search/Resolve-only-the-top-10-clientips-in-DNS/m-p/37392#M8345 <P>I'm quite sure it's only resolving the top 10 results, but it's doing this in preview mode. So it's executing the lookup with the partial results multiple times until the search is finished.</P> Fri, 01 Jul 2011 18:20:38 GMT ziegfried 2011-07-01T18:20:38Z https://community.splunk.com/t5/Splunk-Search/Resolve-only-the-top-10-clientips-in-DNS/m-p/37391#M8344 <P>I'm trying to figure out the best way to have splunk resolve hostnames for only the top 10 clientips (by MB's transferred) from my access-combined logs. I've got the reverse DNS lookup working, and so for I've created the following search string:</P> <PRE> eventtype="myevents" | eval MB = bytes/1024/1024 | chart sum(MB) as TotalMB by clientip | sort -TotalMB | head 10 | lookup dnsLookup ip as clientip | eval hostname=coalesce(host,clientip) | table hostname, TotalMB </PRE> <P>I don't believe this is doing what I want though, it looks like its still trying to resolve all the clientip's, not just the top 10. What am I doing wrong here?</P> Thu, 30 Jun 2011 23:53:33 GMT https://community.splunk.com/t5/Splunk-Search/Resolve-only-the-top-10-clientips-in-DNS/m-p/37391#M8344 jstockamp 2011-06-30T23:53:33Z https://community.splunk.com/t5/Splunk-Search/Resolve-only-the-top-10-clientips-in-DNS/m-p/37392#M8345 <P>I'm quite sure it's only resolving the top 10 results, but it's doing this in preview mode. So it's executing the lookup with the partial results multiple times until the search is finished.</P> Fri, 01 Jul 2011 18:20:38 GMT https://community.splunk.com/t5/Splunk-Search/Resolve-only-the-top-10-clientips-in-DNS/m-p/37392#M8345 ziegfried 2011-07-01T18:20:38Z