Update: Thanks for all the help. I was able to get an assist from a colleague and wanted to provide his search incase it works for anyone else. In a nutshell, the line rows=5, you can change to whatever number you need, but in the output if there are more than 5 hosts it will show you ... at the bottom so you know there is more, the columns on the right show you the initial amount of hosts and the amount if truncated | tstats values(host) as host where index=* by index
| foreach host ``` This code will only show you the first n values in the values() command```
[ eval rows=5
| eval mvCountInitial=mvcount('<<FIELD>>')
| eval <<FIELD>>=if(mvcount('<<FIELD>>')>$rows$, mvappend(mvindex('<<FIELD>>',0,$rows$-1),"..."), '<<FIELD>>')
| eval mvCountTruncated=if(mvcount('<<FIELD>>')>$rows$,mvcount('<<FIELD>>')-1,mvcount('<<FIELD>>'))
| fields - rows]
| rename mvCountInitial as "Total Host Count" mvCountTruncated as Truncated
... View more
