Tabular OperatorsFilter Operators
tail
Returns up to the specified number of most recent rows by `$time` descending.
Returns up to the specified number of most recent rows by $time descending.
Unlike take, tail always sorts by $time descending to return the latest events.
Rows with null $time are sorted to the end (after all timestamped rows).
Syntax
tail countLimit output to the N most recent rows by $time
Parameters
| Name | Description |
|---|---|
| count | Maximum number of rows to return |
Examples
Example 1
datatable(raid:string, $time:datetime)[
"Lindisfarne", datetime(2024-06-08),
"Paris", datetime(2024-03-28),
"York", datetime(2024-11-01),
"Normandy", datetime(2024-01-01),
"Stamford Bridge", datetime(2024-09-25)
]
| tail 3| raid (string) | $time (datetime) |
|---|---|
| Lindisfarne | 2024-06-08T00:00:00Z |
| Stamford Bridge | 2024-09-25T00:00:00Z |
| York | 2024-11-01T00:00:00Z |