I need to provide feedback on ways logging formats could be improved. To that end, I'm trying to create a search that ends with: | stats values(source) values(_raw) by index sourcetype so I get some examples of logs, but I only want to see a max of 5 values in the source and _raw columns. I tried using foreach with append, but append isn't streaming, so I manually created 204 lines like this: index=index1 sourcetype=sourcetype1 | head 5 | append [ search index=index1 sourcetype=sourcetype2 | head 5 ] | append [ search index=index2 sourcetype=sourcetype1 | head 5 ] ... It took a long time in "Parsing job...", but eventually produced the results I wanted. What are some different ways of getting this result? ... View more