Solved: Variable number in head command

Splunk Search

How can I return calculated (variable) number of top events?
This doesn't work:
... | eval x=5 | head x

1 Solution

Solution

Got it:
... | eval x=5 | streamstats c | where c<=x

Solution

Got it:
... | eval x=5 | streamstats c | where c<=x

Get Updates on the Splunk Community!

This puzzle series (first published here) is based on analysing words.Some of the statements in your puzzle ...

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Variable number in head command