How can I edit my search to only use the 3 most recent sources?

[MichaelPriest]

I have a file that gets uploaded into Splunk every month and I use it to produce a graph using the data from the past 3 months. When I upload a new file, I'd like the search to only select the most recent 3 sources. It may be trivial, but how can I write the search to use only the 3 most recent sources?

Here's my current search:

 index="test_inputs" source="Servers ALL*" Application!="n/a" Application!="." Type="Vuln" | chart count by Application source| addtotals | sort -Total | fields - Total

[martin_mueller]

Alternatively, use the time range picker to restrict your search to the last three months. Then your search will still work and display three months' worth of data even if you switch from monthly to weekly files, for example.

[mrobichaud_splu · Accepted solution]

The metadata command can list sources, which can be used as a subsearch. This will search the top three sources:

[| metadata type=sources | sort recentTime desc | head 3 | fields source]  | additional_commands_after_pipe...

Metadata takes an index parameter. If you need to limit it to certain sources, you'd need to search for it:

[| metadata type=sources index="test_inputs" | search source="Servers ALL*" | sort recentTime desc | head 3 | fields source]   | additional_commands_after_pipe...

Subsearches can be slow, but the metadata command should be reasonably fast.