Splunk Search

How can I make Splunk stop searching after it finds a set number of results?

Path Finder

Hey there!

I have a query that will always only return one result. This result will be different depending on the input from a dashboard, but no matter the input the number of results will be either zero or one.

Is there a way to have Splunk stop querying after it finds this result? I'm searching through a lot of data so it doesn't make sense to keep searching after finding what I wanted. This is using the table command.

1 Solution

Motivator

Use the head command prior to the table command:

...your search... | head 1 | table...

See http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Head for a description of the head command.

View solution in original post

Motivator

Use the head command prior to the table command:

...your search... | head 1 | table...

See http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Head for a description of the head command.

View solution in original post

Path Finder

Oh wow, I was putting the head command at the end. Thanks!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!