Return only the first matching event

[blurblebot]

Is there any way to make Splunk stop a search once it has found the first event matching your search? limit=1 in the first section of the search isn't doing it for me.

Right now, I have a search that looks for src_ip=10.3.2.4. The events this search returns all have a field/value pair of location=whatevs. This location will never change in relation to the src_ip (just pretend with me).

With the search "src_ip=10.3.2.4 | top location limit=1" as one of many executed on a dashboard enveloped by a timeRangePicker, the search, of course searches the entire time range before calculating the top value.

If I switch it to "src_ip=10.3.2.4 limit=1 | top location", Splunk still searches the full time range before completing.

This is eating extra cycles, and I want Splunk to take the first match of src_ip=10.3.2.4 and give me the value it finds for location in that first found event, and then quit looking.

Any ideas?

Thanks!

-s

[gkanapathy · Accepted solution]

Use:

... | head 1

[rogerdpack]

Is this more efficient?  Like it'll stop the query fast?

[blurblebot]

How could I forget that? I think "use head" would have sufficed. Facepalm. Thx.