Splunk Search

Expanding data within my eval search

AttarSingh1
Explorer

index=data severity IN ("critical","high","medium","low")
| eval TopHost =
[ search index=tenable severity IN ("critical","high","medium","low")
| where len(dnsName)>0
| dedup dnsName,solution
| dedup dnsName,pluginText
| rex field=pluginName "^(?<VulnName>(?:\w+\s+){2})"
| dedup dnsName,VulnName
| top limit=1 dnsName
| rename dnsName as query
| fields query
| head 1]


| where dnsName=TopHost
| table dnsName, ip

 

My query above works, but missing one thing. Right now it is getting the first result ( using head command ). I am trying to do first 5 results and store that to my eval variable. I tried to change head 5 but got errors. Any help is appreciated. Thanks

Attached error

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=data severity IN ("critical","high","medium","low")
| eval TopHost =
split([ search index=tenable severity IN ("critical","high","medium","low")
| where len(dnsName)>0
| dedup dnsName,solution
| dedup dnsName,pluginText
| rex field=pluginName "^(?<VulnName>(?:\w+\s+){2})"
| dedup dnsName,VulnName
| top limit=1 dnsName
| rename dnsName as query
| fields query
| head 5
| format "\"" "" "" "" "" "\""]," ")
| where dnsName=TopHost
| table dnsName, ip

This assumes dnsName has no spaces in it

0 Karma
Get Updates on the Splunk Community!

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Automatic Discovery Part 2: Setup and Best Practices

In Part 1 of this series, we covered what Automatic Discovery is and why it’s critical for observability at ...