topic Re: How to make Splunk stop searching after it finds a certain amount of results? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-make-Splunk-stop-searching-after-it-finds-a-certain/m-p/323919#M96676 <P>Have you tried event sampling?<BR /> <A href="https://www.function1.com/2016/08/event-sampling-new-splunk-6-4-feature">https://www.function1.com/2016/08/event-sampling-new-splunk-6-4-feature</A></P> Mon, 24 Jul 2017 15:48:07 GMT rroberts 2017-07-24T15:48:07Z How to make Splunk stop searching after it finds a certain amount of results? https://community.splunk.com/t5/Splunk-Search/How-to-make-Splunk-stop-searching-after-it-finds-a-certain/m-p/323918#M96675 <P>I have tried head 100, but it seems like it does a regular search and then gives me 100 results because it takes the same amount of time as a full search. I am looking for a way not to search 180 million entries when I only need 100 or so results.</P> Mon, 24 Jul 2017 14:33:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-Splunk-stop-searching-after-it-finds-a-certain/m-p/323918#M96675 rockyrush 2017-07-24T14:33:55Z Re: How to make Splunk stop searching after it finds a certain amount of results? https://community.splunk.com/t5/Splunk-Search/How-to-make-Splunk-stop-searching-after-it-finds-a-certain/m-p/323919#M96676 <P>Have you tried event sampling?<BR /> <A href="https://www.function1.com/2016/08/event-sampling-new-splunk-6-4-feature">https://www.function1.com/2016/08/event-sampling-new-splunk-6-4-feature</A></P> Mon, 24 Jul 2017 15:48:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-Splunk-stop-searching-after-it-finds-a-certain/m-p/323919#M96676 rroberts 2017-07-24T15:48:07Z Re: How to make Splunk stop searching after it finds a certain amount of results? https://community.splunk.com/t5/Splunk-Search/How-to-make-Splunk-stop-searching-after-it-finds-a-certain/m-p/323920#M96677 <P>Not exactly what I was hoping for. I want the latest 100 then I want to to stop searching entirely and just display the results it already has.</P> Mon, 24 Jul 2017 16:45:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-Splunk-stop-searching-after-it-finds-a-certain/m-p/323920#M96677 rockyrush 2017-07-24T16:45:57Z Re: How to make Splunk stop searching after it finds a certain amount of results? https://community.splunk.com/t5/Splunk-Search/How-to-make-Splunk-stop-searching-after-it-finds-a-certain/m-p/323921#M96678 <P>What is your search? head should prevent a full search from being executed, unless it comes after a command that requires the data set to come back to the search head</P> Mon, 24 Jul 2017 16:52:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-Splunk-stop-searching-after-it-finds-a-certain/m-p/323921#M96678 jplumsdaine22 2017-07-24T16:52:25Z Re: How to make Splunk stop searching after it finds a certain amount of results? https://community.splunk.com/t5/Splunk-Search/How-to-make-Splunk-stop-searching-after-it-finds-a-certain/m-p/323922#M96679 <P>Thanks so much! It was after commands which collected all the search terms</P> Mon, 24 Jul 2017 19:10:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-Splunk-stop-searching-after-it-finds-a-certain/m-p/323922#M96679 rockyrush 2017-07-24T19:10:36Z