Returns a limited number of events, starting with the oldest, sorted by the the event timestamp. This function is equivalent to the command-line head tool.
The parameter name for
limit can be omitted; the following forms are equivalent:
Select the 10 oldest with
loglevel=ERROR | head(10)
Select the 100 oldest events and group them by
head(limit=100) | groupby(loglevel)