Is there any way to make Splunk stop a search once it has found the first event matching your search? limit=1 in the first section of the search isn't doing it for me.
Right now, I have a search that looks for src_ip=10.3.2.4. The events this search returns all have a field/value pair of location=whatevs. This location will never change in relation to the src_ip (just pretend with me).
With the search "src_ip=10.3.2.4 | top location limit=1" as one of many executed on a dashboard enveloped by a timeRangePicker, the search, of course searches the entire time range before calculating the top value.
If I switch it to "src_ip=10.3.2.4 limit=1 | top location", Splunk still searches the full time range before completing.
This is eating extra cycles, and I want Splunk to take the first match of src_ip=10.3.2.4 and give me the value it finds for location in that first found event, and then quit looking.
Any ideas?
Thanks!
-s
