Limiting Returned Events
Some functions include the limit
parameter available in some functions to also limit the output:
Functions with the limit include
dropEvent(), eval(), fieldset().
For example:
groupBy([user],function=count(),limit=5)| user | _count |
|---|---|
| adamsb | 2 |
| fosterd | 1 |
| hillp | 2 |
| parkerj | 1 |
| turnerm | 4 |
The order is not sorted or organized by value, but by the incoming value.
In this case, the limit
parameter just stops generating matching values when the limit reached.
For selecting or ordering the output, see Sorting Data.
For other situations where the function does not support limiting the
output, make use of one of the functions that limits the overall output,
such as head() or tail(). These
get the first or last N events from an event set. In a query where there
is no other sorting or aggregation, this will be based on the timestamp of
the events in question, i.e. head() will return the
earliest N events.
If an aggregation is applied, then it will return the number of events as sorted/aggregated by the previous aggregation.