Splunk® Cloud Services

SPL2 Search Reference

head command usage

Differences between SPL and SPL2

Command options must be specified before command arguments

Version Example
SPL ...head limit=10 (x>10) keeplast=true
SPL2 ...head keeplast=true while (x>10) 10

New while keyword

SPL2 uses the while keyword to indicate that the head command accumulates events until the while condition is not met.

Version Example
SPL ...head limit=20 (x>10)
SPL2 ...head while (x>10) 20


The limit keyword is not supported in SPL2

The syntax has been simplified and the limit keyword is no longer necessary.

Version Example
SPL ...head limit=10
SPL2 ...head 10


The null argument is not supported in SPL2

The null=<boolean> argument is not supported. To handle fields with null values, you must use the isnull() or isnotnull() function.

Version Example Example
SPL ...head null=true ...head null=false
SPL2 ...head while (isnotnull(host)) ...head while (isnull(host) OR host="localhost")

See also

head command
head command overview
head command syntax details
head command examples
Last modified on 20 October, 2020
head command syntax details   head command examples

This documentation applies to the following versions of Splunk® Cloud Services: current


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters