Finds a limited number of events, starting with the oldest, sorted by the the event timestamp. This function is equivalent to the command-line head tool.
Hide omitted argument names for this function
Omitted Argument NamesThe argument name for
limit
can be omitted; the following forms of this function are equivalent:logscale Syntaxhead("value")
and:
logscale Syntaxhead(limit="value")
These examples show basic structure only.
The maximum value of the limit
parameter can be
adjusted using the
StateRowLimit
dynamic
configuration.
head()
Examples
Select the 10 oldest with
loglevel=ERROR
logscaleloglevel=ERROR | head(10)
Select the 100 oldest events and group them by
loglevel
logscalehead(limit=100) | groupby(loglevel)