Tabular OperatorsFilter Operators
tail
Returns up to the specified number of most recent rows by `timestamp` descending.
Unlike take, tail always sorts by timestamp descending to return the latest events.
Rows with null timestamp are sorted to the end (after all timestamped rows). Rows sharing a
timestamp come latest-ingested first.
Syntax
tail countLimit output to the N most recent rows by timestamp
Parameters
| Name | Description |
|---|---|
| count | Maximum number of rows to return |
Examples
Example 1
datatable(raid:string, timestamp:datetime)[
"Lindisfarne", datetime(2024-06-08),
"Paris", datetime(2024-03-28),
"York", datetime(2024-11-01),
"Normandy", datetime(2024-01-01),
"Stamford Bridge", datetime(2024-09-25)
]
| tail 3| raid (string) | timestamp (datetime) |
|---|---|
| Lindisfarne | 2024-06-08T00:00:00Z |
| Stamford Bridge | 2024-09-25T00:00:00Z |
| York | 2024-11-01T00:00:00Z |