Hello, i'm trying to run a query but I would like it to stop at the first 10,000 events and I don't mean to display the first 10,000 events. The issue is that I'm building a front end for errors and if a user chooses errors in the last 10 minutes, there could be 100,000 and "head" or "streamstats count" will display the first 10,000 but the query continues to run in the background. I want the query to stop once it hits 10,000 events. Does anyone know of a way to accomplish this?
| streamstats count | where count<=10000 will display 10000 but give me 13,887 events (7/25/18 8:54:27.000 AM to 7/25/18 8:59:27.000 AM)
| head 10000 does the same
hello there,
use | head 10000
before any stats
or streamstats
or anything
... your search ... | head 10000 | ... more stuff tat you want ...
Can you provide some more information like screenshots of your search and results. The reason I ask is, head
command is working perfectly for me. my search | head 10000
stops running as soon as it hits 10k results.