head command usage

Differences between SPL and SPL2

Command options must be specified before command arguments

Version	Example
SPL	...head limit=10 (x>10) keeplast=true
SPL2	...head keeplast=true while (x>10) 10

New while keyword

SPL2 uses the while keyword to indicate that the head command accumulates events until the while condition is not met.

Version	Example
SPL	...head limit=20 (x>10)
SPL2	...head while (x>10) 20

The limit keyword is not supported in SPL2

The syntax has been simplified and the limit keyword is no longer necessary.

Version	Example
SPL	...head limit=10
SPL2	...head 10

The null argument is not supported in SPL2

The null=<boolean> argument is not supported. To handle fields with null values, you must use the isnull() or isnotnull() function.

Version	Example	Example
SPL	...head null=true	...head null=false
SPL2	...head while (isnotnull(host))	...head while (isnull(host) OR host="localhost")

See also

head command

head command overview

head command syntax details

head command examples