Get the 10 recent events for each host.

[allen_hunter]

I am trying to write a search that will pull the 10 (or so) most recent events for each host. The tail and head commands apparently do not allow any grouping, and I am trying to wrap my head around how to do this.

I know this does not work, but this is what I am looking for:

index=index1
| head 10 by host

The closest I can come up with is:

 index=index1
| stats values(_raw) by host

But that still gives me everything in the time range, not just the last 10 events per host.

[richgalloway · Accepted solution]

There are couple of other ways to do that.  I like the dedup command because it's simple.  It retains the most recent n events by the specified field(s).

index = index1
| dedup 10 host

 This method is for those who dislike dedup.  It counts events by host and then takes those with a count <=10.

index = index1
| streamstats count by host
| where count <= 10
| fields - count

[allen_hunter]

I did not know you could add a count to the dedup statement. This is good info to know. 

I completely forgot about trying the streamstats method. But I have used it in the past. Will put it in my notes for future reference.

Thanks!

[allen_hunter]

This seems to work, but feels a little "hack-ish":

index=txdir_mainframe 
| transaction host maxevents=20
| dedup host

If anyone has any better ideas, I am open to suggestions.

Thanks,