Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How can we fetch only 8 rows from a lookup?

$
0
0
Our top user ended up with the following query - | inputlookup WHERE [ | makeresults count=8 | streamstats count | eval WEEKSTART=relative_time($MYWEEKPICKER$,"-" + tostring(count - 1) + "w@w0") | table WEEKSTART ]| rename WEEKSTART AS _time The intention of `makeresults count=8` is to create a dummy eight rows and by doing it, limit the results to only 8 rows starting with `$MYWEEKPICKER$`. Can we do it in any other way?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>