Splunk Search

Trying to get the first 10 events based on sourcetype

Runals
Motivator

I'm trying to get the first 10 or so events per sourcetype but the methodology is escaping me. You can't simply use the head command. I also am wanting all fields in the event so can't do something like | top 10 by sourcetype as that doesn't specify any fields. Any thoughts?

Tags (2)
0 Karma
1 Solution

kaufmanm
Communicator

You can use the dedup command to only keep 10 of each sourcetype, returning the full events:

* | dedup 10 sourcetype

View solution in original post

kaufmanm
Communicator

You can use the dedup command to only keep 10 of each sourcetype, returning the full events:

* | dedup 10 sourcetype

Runals
Motivator

Outstanding! thanks much.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...