Splunk 7.x Quick Start Guide

Head/tail

The head command returns the last N number of results (default = 10) in descending received order.

You can also utilize an eval-type argument in parentheses with the head command to display all initial results up until the first result where the eval-expression evaluates to false; there is a keeplast=t option to display the first non-match event.

You can also specify a limit='X' value to limit the return set size (but you can't use an integer and the limit options together). If both a numeric limit and an eval expression are used, the smaller of the two constraints applies:

index = weblogs_90d_eidx sourcetype=access* | head   // first 10 events... | head limit=20                            // first 20 events... | head keeplast=t (status <= 200) // all events ...