Splunk Search

First x results by host.

marquiselee
Path Finder

I want to get the first(most recent) say 10 results that meet my criteria per host. Because my environment has 100s of hosts, some of which are way more active than others... I need a way to keep splunk from searching for matches on the hosts where I've already matched the 10 results I'm seeking.

I'd imagine it would look something like this...

index=main sourcetype=ingest_logs status=error | head 10 by host | table _time host _raw

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

"by host" is not valid for the head command. Just 'head 10' should do the job.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

somesoni2
Revered Legend

Are you looking for something like this
host1 firstrecord...
host1 secondrecord..
.......
.......
host1 tenthrecord
host2 firstrecord...
host2 secondrecord..
.......
.......
host2 tenthrecord
....

0 Karma

richgalloway
SplunkTrust
SplunkTrust

"by host" is not valid for the head command. Just 'head 10' should do the job.

---
If this reply helps you, Karma would be appreciated.
0 Karma

linu1988
Champion

its not possible if you don't have a reference. you can make a outputcsv host.csv. then in the next search

index=main sourcetype=ingest_logs status=error host NOT [|inputcsv host.csv]| head 10 by host | table _time host _raw

something like this...

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...