Splunk Search

Expanding data within my eval search

AttarSingh1
Explorer

index=data severity IN ("critical","high","medium","low")
| eval TopHost =
[ search index=tenable severity IN ("critical","high","medium","low")
| where len(dnsName)>0
| dedup dnsName,solution
| dedup dnsName,pluginText
| rex field=pluginName "^(?<VulnName>(?:\w+\s+){2})"
| dedup dnsName,VulnName
| top limit=1 dnsName
| rename dnsName as query
| fields query
| head 1]


| where dnsName=TopHost
| table dnsName, ip

 

My query above works, but missing one thing. Right now it is getting the first result ( using head command ). I am trying to do first 5 results and store that to my eval variable. I tried to change head 5 but got errors. Any help is appreciated. Thanks

Attached error

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=data severity IN ("critical","high","medium","low")
| eval TopHost =
split([ search index=tenable severity IN ("critical","high","medium","low")
| where len(dnsName)>0
| dedup dnsName,solution
| dedup dnsName,pluginText
| rex field=pluginName "^(?<VulnName>(?:\w+\s+){2})"
| dedup dnsName,VulnName
| top limit=1 dnsName
| rename dnsName as query
| fields query
| head 5
| format "\"" "" "" "" "" "\""]," ")
| where dnsName=TopHost
| table dnsName, ip

This assumes dnsName has no spaces in it

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...