head search command

This search command provides the first N number of search results. When you run this command, the events that were indexed first (the earliest records) are displayed in ascending order. You can specify a limit in the syntax to return the maximum number (N) of search results. If you run this command without specifying a limit, by default the product returns the first 10 results.

Syntax

OR

In the preceding syntax, n or <integer> refers to an integer value that indicates the maximum number of records that you want to see.

Short examples

Example 1: Return the first 10 records.

Example 2: Return the first 20 records.

Example 2: Return the first 2 records.

Long example

The following sample data and sample indexed data (displayed on the Search tab) will help you understand the examples of using the head command.

• Sample data
•  
• Sample indexed data
• head with limit option
•  

Sample data

Back to examples ↑

Sample indexed data

Back to examples ↑

head with limit option

In this example, you use the command to find the first two records that occurred (as per the event time stamp).

Command

OR

Output

Back to examples ↑

Note

Using very large limit sizes can negatively impact your system performance.