Finds the newest events.

ParameterTypeRequiredDefaultDescription
limit[a]numberoptional[b]200 The maximum number of events to find.
  Minimum1 
  Maximum20,000 

[a] The argument name limit can be omitted.

[b] Optional parameters use their default value unless explicitly set

Omitted Argument Names

The argument name for limit can be omitted; the following forms of this function are equivalent:

logscale
tail("1")

and:

logscale
tail(limit="1")

The maximum value of the limit parameter can be adjusted using the StateRowLimit dynamic configuration.

tail() Examples

Select the 10 newest with loglevel=ERROR

logscale
loglevel=ERROR
| tail(10)

Select the 100 latest events and group them by loglevel

logscale
tail(limit=100)
| groupby(loglevel)

Although the default is 200, if a number higher than this is specified, LogScale will attempt to return as many results up to that number. For example:

logscale
"GET /_images"
| tail(1000)

Will return up to 1000 events matching an HTTP GET request for files in the _images directory. If there are only 287 matching events, all 287 will be returned.