Documentation > Splunk > Search Reference > head

Search Reference

 


Introduction
Search Overview
Search Reference Overview
Search Commands and Functions
Search Command Reference
Custom Search Commands
Search in the CLI

head

Contents

head

Synopsis

Returns the first n number of specified results.

Syntax

head [<N> | <eval-expression>] [limit=<int>] [null=<bool>] [keeplast=<bool>]

Optional arguments

eval-expression
Syntax: <eval-math-exp> | <eval-concat-exp> | <eval-compare-exp> | <eval-bool-exp> | <eval-function-call>
Description: A valid eval expression that evaluates to a Boolean. Splunk returns results until this expression evaluates to false. For more information, see the Functions for eval.
keeplast
Syntax: keeplast=<bool>
Description: Controls whether or not to keep the last event, which caused the eval expression to evaluate to false (or NULL).
limit
Syntax: limit=<int>
Description: Another way to specify the number of results to return. Defaults to 10.
<N>
Syntax: <int>
Description: The number of results to return. If none is specified, Defaults to 10.
null
Syntax: null=<bool>
Description: If instead of specifying a number N, you use a boolean eval expression, this specifies how a null result should be treated. For example, if the eval expression is (x > 10) and the field x does not exist, the expression evaluates to NULL instead of true or false. So, null=true means that the head command continues if it gets a null result, and null=false means the command stops if that happens.

Description

Returns the first n results, or 10 if no integer is specified. New for 4.0, can provide a boolean eval expression, in which case we return events until that expression evaluates to false.

Examples

Example 1: Return the first 20 results.

... | head 20

Example 2: Return events until the time span of the data is >= 100 seconds

... | streamstats range(_time) as timerange | head (timerange<100)

See also

reverse, tail

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the head command.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.1.4/SearchReference/Head"

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!