Solved: Variable number in head command

Splunk Search

How can I return calculated (variable) number of top events?
This doesn't work:
... | eval x=5 | head x

1 Solution

Solution

Got it:
... | eval x=5 | streamstats c | where c<=x

Solution

Got it:
... | eval x=5 | streamstats c | where c<=x

Get Updates on the Splunk Community!

OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability As ...

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...

Variable number in head command