Splunk Search

Unable to search for the first 10,000 event only

New Member

Hello, i'm trying to run a query but I would like it to stop at the first 10,000 events and I don't mean to display the first 10,000 events. The issue is that I'm building a front end for errors and if a user chooses errors in the last 10 minutes, there could be 100,000 and "head" or "streamstats count" will display the first 10,000 but the query continues to run in the background. I want the query to stop once it hits 10,000 events. Does anyone know of a way to accomplish this?

| streamstats count | where count<=10000 will display 10000 but give me 13,887 events (7/25/18 8:54:27.000 AM to 7/25/18 8:59:27.000 AM)
| head 10000 does the same

Tags (1)
0 Karma

Ultra Champion

hello there,
use | head 10000 before any stats or streamstats or anything
... your search ... | head 10000 | ... more stuff tat you want ...

0 Karma


Can you provide some more information like screenshots of your search and results. The reason I ask is, head command is working perfectly for me. my search | head 10000 stops running as soon as it hits 10k results.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...