Solved: Variable number in head command

Splunk Search

How can I return calculated (variable) number of top events?
This doesn't work:
... | eval x=5 | head x

1 Solution

Solution

Got it:
... | eval x=5 | streamstats c | where c<=x

Solution

Got it:
... | eval x=5 | streamstats c | where c<=x

Get Updates on the Splunk Community!

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Variable number in head command