Splunk Search

How can I edit my search to only use the 3 most recent sources?

MichaelPriest
Communicator

I have a file that gets uploaded into Splunk every month and I use it to produce a graph using the data from the past 3 months. When I upload a new file, I'd like the search to only select the most recent 3 sources. It may be trivial, but how can I write the search to use only the 3 most recent sources?

Here's my current search:

 index="test_inputs" source="Servers ALL*" Application!="n/a" Application!="." Type="Vuln" | chart count by Application source| addtotals | sort -Total | fields - Total
Tags (3)
0 Karma
1 Solution

mrobichaud_splu
Splunk Employee
Splunk Employee

The metadata command can list sources, which can be used as a subsearch. This will search the top three sources:

[| metadata type=sources | sort recentTime desc | head 3 | fields source]  | additional_commands_after_pipe...

Metadata takes an index parameter. If you need to limit it to certain sources, you'd need to search for it:

[| metadata type=sources index="test_inputs" | search source="Servers ALL*" | sort recentTime desc | head 3 | fields source]   | additional_commands_after_pipe...

Subsearches can be slow, but the metadata command should be reasonably fast.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Alternatively, use the time range picker to restrict your search to the last three months. Then your search will still work and display three months' worth of data even if you switch from monthly to weekly files, for example.

0 Karma

mrobichaud_splu
Splunk Employee
Splunk Employee

The metadata command can list sources, which can be used as a subsearch. This will search the top three sources:

[| metadata type=sources | sort recentTime desc | head 3 | fields source]  | additional_commands_after_pipe...

Metadata takes an index parameter. If you need to limit it to certain sources, you'd need to search for it:

[| metadata type=sources index="test_inputs" | search source="Servers ALL*" | sort recentTime desc | head 3 | fields source]   | additional_commands_after_pipe...

Subsearches can be slow, but the metadata command should be reasonably fast.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...