Finds the newest events.

ParameterTypeRequiredDefaultDescription
limit[a]numberoptional[b]200 The maximum number of events to find.
  Minimum1 
  Maximum20,000 

[a] The argument name limit can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

The maximum value of the limit parameter can be adjusted using the StateRowLimit dynamic configuration.

tail() Examples

Select the 10 newest where loglevel=ERROR:

logscale
loglevel=ERROR
| tail(10)

Select the 100 latest events and group them by loglevel

logscale
tail(limit=100)
| groupby(loglevel)

Although the default is 200, if a number higher than this is specified, LogScale will attempt to return as many results up to that number. For example:

logscale
"GET /_images"
| tail(1000)

Will return up to 1000 events matching an HTTP GET request for files in the _images directory. If there are only 287 matching events, all 287 will be returned.