Splunk Search

Can you skip the first x rows returned in a search?

ewanbrown
Path Finder

Hi,

If I have a query which returns 100 rows I'd like to be able to only get rows 11-100 shown (and if 200 only rows 11-200)

I have looked for an offset command similar to head or tail but I can't see one. Do you know how I could go about this?

Thanks

1 Solution

harishalipaka
Motivator

hi @ewanbrown

try like this

| makeresults 
 | fields - _time 
 | eval data="A1 A2 A3 A4 A5 A6 A7 A8 A9 A10 A11 A12 A13 A14 A15 A16 A17 A18" 
 | makemv data delim=";" 
 | mvexpand data 
 | makemv data delim=" " | mvexpand data |streamstats count as result |where result >10 |fields - result
Thanks
Harish

View solution in original post

harishalipaka
Motivator

hi @ewanbrown

just add this end of your query : |streamstats count as result |where result >10

Thanks
Harish

ewanbrown
Path Finder

Thanks! That works

0 Karma

harishalipaka
Motivator

hi @ewanbrown

try like this

| makeresults 
 | fields - _time 
 | eval data="A1 A2 A3 A4 A5 A6 A7 A8 A9 A10 A11 A12 A13 A14 A15 A16 A17 A18" 
 | makemv data delim=";" 
 | mvexpand data 
 | makemv data delim=" " | mvexpand data |streamstats count as result |where result >10 |fields - result
Thanks
Harish

adonio
Ultra Champion

nice idea @harishalipaka!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...