First x results by host.

[marquiselee]

I want to get the first(most recent) say 10 results that meet my criteria per host. Because my environment has 100s of hosts, some of which are way more active than others... I need a way to keep splunk from searching for matches on the hosts where I've already matched the 10 results I'm seeking.

I'd imagine it would look something like this...

index=main sourcetype=ingest_logs status=error | head 10 by host | table _time host _raw

[somesoni2]

Are you looking for something like this
host1 firstrecord...
host1 secondrecord..
.......
.......
host1 tenthrecord
host2 firstrecord...
host2 secondrecord..
.......
.......
host2 tenthrecord
....

[richgalloway · Accepted solution]

"by host" is not valid for the head command. Just 'head 10' should do the job.

[linu1988]

its not possible if you don't have a reference. you can make a outputcsv host.csv. then in the next search

index=main sourcetype=ingest_logs status=error host NOT [|inputcsv host.csv]| head 10 by host | table _time host _raw

something like this...