Page tree
Skip to end of metadata
Go to start of metadata

This search command provides the last N number of search results. When you run this command, the events that were indexed last (most recently) are displayed in ascending order.

You can specify a limit in the syntax to return the maximum number (N) of search results. If you run this command without specifying a limit, by default the product returns the first 10 results.

This topic contains the following information:

For a list of all search commands, see Search commands.


tail N


tail limit=<integer>

In the preceding syntax, N or <integer> refers to an integer value that indicates the maximum number of records that you want to see.

Short examples

Example 1: Return the last 10 records.

... | tail 

Example 2: Return the last 20 records.

... | tail limit=20

Example 2: Return  the last 2 records.

... | tail 2

Long example

The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the tail command. 

Sample data - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100 - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150 - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200 - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100

Back to examples ↑

Sample indexed data - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100 |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200 |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png - - [11/Jul/2013:15:02:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 150 |ResponseSize=150|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=201 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png - - [11/Jul/2013:15:01:52 -0700] "GET /themes/ComBeta/images/bullet.png 
HTTP/1.1" 404 100 |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=404 |RequestType=GET|RequestURL=/themes/ComBeta/images/bullet.png

Back to examples ↑

tail with limit option

In this example, you use the command to find the last two records that occurred (as per the event time stamp).


... | tail 2


... | tail limit=2

Output - - [11/Jul/2013:15:04:52 -0700] "POST /themes/ComBeta/images/bullet.png 
HTTP/1.1" 200 100 |ResponseSize=100|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=200 |RequestType=POST|RequestURL=/themes/ComBeta/images/bullet.png - - [11/Jul/2013:15:03:52 -0700] "PUT /themes/ComBeta/images/bullet.png 
HTTP/1.1" 201 200 |ResponseSize=200|COLLECTOR_NAME=u4 |ClientIp= |ResponseCode=201 |RequestType=PUT|RequestURL=/themes/ComBeta/images/bullet.png

Back to examples ↑


Using very large limit sizes can negatively impact your system performance.