`head`

Use the head command to display the first n number of results.

Syntax

head [limit=<limit>]

Parameters

The following table lists the parameters used in this command, along with their descriptions.

Parameter	Description
`limit`	Specify the number of entries you want to see. If no value is specified, then the default value of `10` is used.

Note

For query, the default sort order is time descending. So head command returns the most recent, unless the sort order is overridden using the sort command.
For export, there is no default sort order by time. head returns most recent log data in the specified time filter but the data is not sorted by time, unless the sort order is overridden using the sort command.
To override the sort order, use sort command before the head command.

For examples of using this command in typical scenarios, see:

The following command returns the first 5 fatal logs:

severity = fatal | head limit=5

The following command returns the first 5 distinct severity results:

* | distinct severity | head limit=5

The following command finds the first 20 fatal logs and calculates their average iplen:

severity = fatal | head limit=20 | stats avg(iplen)

head