Retrieves the oldest events first and returns a specified maximum number of events. The head() function sorts events by either @timestamp or @ingesttimestamp, depending on the selected query parameters. This function is equivalent to the command-line head tool.

ParameterTypeRequiredDefault ValueDescription
limit[a]numberoptional[b] 200 The argument given to this parameter determines the limit on the number of events included in the result of the function. The default argument is default. The maximum is controlled by the StateRowLimit dynamic configuration, which is StateRowLimit by default. If the argument is max (limit=max), then the value of StateRowLimit is used.
  Minimum0 

[a] The parameter name limit can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

Note

The head() function is often used with Sequence Query Functions, as these functions must be used after an aggregator function to ensure event ordering.

head()Examples

Click + next to an example below to get the full details.

Calculate Running Average of Field Values

Calculate a running average of values in a dataset using the accumulate() function

Query
logscale
head()
| accumulate(avg(value))
Introduction

In this example, the accumulate() function is used with the avg() function to calculate a running average of the field value.

Note that the accumulate() function must be used after an aggregator function, in this example the head() function, to ensure event ordering.

Example incoming data might look like this:

keyvalue
a5
b6
c1
d2
Step-by-Step
  1. Starting with the source repository events.

  2. logscale
    head()

    Ensures that the events are ordered by time, selecting the oldest events.

  3. logscale
    | accumulate(avg(value))

    Computes the running average of all values, including the current one, using the accumulate() function with the avg() aggregator.

  4. Event Result set.

Summary and Results

The query is used to calculate the running average of fields. The query calculates moving averages that change as new values arrive.

Sample output from the incoming example data:

_avgkeyvalue
5a5
5.5b6
4c1
3.5d2