How to show XX lines per sourcetype per host

[a212830]

Hi,

I want to look at the format for a number of hosts that are using the same sourcetype (I suspect that the format is different per host). Is there a way to do that?

Something like:

Host 1 - event 1
Host 1 - event 2
Host 1 - event 3...

Host 2 - event 1
Host 2 - event 2
Host 2 - event 3...

[gschmitz]

sourcetype=foo (host=Host1 OR host=Host2) |table host, _raw ?

[gschmitz]

Hence my question mark. The answer I agve was a bit too obvious, so I already figured I was missing some detail.
I haven't tried it, but what would top 3 _time by host do? Since every time is probably unique, it should just take the first ones, right?

head unfortunately doesn't have a by clause.

[a212830]

Sorry, thought my example was pretty obvious. Apparently not. I'll try this and see what I get.

Thanks.

[jkat54]

You may also be interested in punct for this analysis

sourcetype=foo host=Host1 | head 10 | table host, punct| append [search sourcetype=foo host=Host2 | head 10 | table host, punct]

[jkat54]

gschmitz was correct, you can't tell him he's not because you didnt give him the correct requirements in your question. To limit the number of events per host use gschmitz answer but add a head. To do so will require two searches. Since we need two searches, we'll use the append command. With the append command, there will be no need to sort by host.

sourcetype=foo host=Host1 | head 10 | table host, _raw | append [search sourcetype=foo host=Host2 | head 10 | table host, _raw ]

[a212830]

That won't do it - I want to limit the number of events per host, and then display them in host and then time order. Not sure if it's even possible..