Trying to get the first 10 events based on sourcetype

[Runals]

I'm trying to get the first 10 or so events per sourcetype but the methodology is escaping me. You can't simply use the head command. I also am wanting all fields in the event so can't do something like | top 10 by sourcetype as that doesn't specify any fields. Any thoughts?

[kaufmanm · Accepted solution]

You can use the dedup command to only keep 10 of each sourcetype, returning the full events:

* | dedup 10 sourcetype

[Runals]

Outstanding! thanks much.