Returns a limited number of events, starting with the oldest, sorted by the the event timestamp. This function is equivalent to the command-line head tool.
Function Traits: Aggregate
, EventSelectingAggregate
The parameter name for limit
can be omitted; the following forms are equivalent:
logscale
head("0")
and:
logscale
head(limit="0")
head()
Examples
Select the 10 oldest with
loglevel=ERROR
logscaleloglevel=ERROR | head(10)
Select the 100 oldest events and group them by
loglevel
logscalehead(limit=100) | groupby(loglevel)