Tabular OperatorsFilter Operators
tail
Returns up to the specified number of most recent rows by `timestamp` descending.
Returns up to the specified number of most recent rows by timestamp descending.
Unlike take, tail always sorts by timestamp descending to return the latest events.
Rows with null timestamp are sorted to the end (after all timestamped rows).
Syntax
tail countLimit output to the N most recent rows by timestamp
Parameters
| Name | Description |
|---|---|
| count | Maximum number of rows to return |
Examples
Example 1
datatable(raid:string, timestamp:datetime)[
"Lindisfarne", datetime(2024-06-08),
"Paris", datetime(2024-03-28),
"York", datetime(2024-11-01),
"Normandy", datetime(2024-01-01),
"Stamford Bridge", datetime(2024-09-25)
]
| tail 3| raid (string) | timestamp (datetime) |
|---|---|
| Lindisfarne | 2024-06-08T00:00:00Z |
| Stamford Bridge | 2024-09-25T00:00:00Z |
| York | 2024-11-01T00:00:00Z |