The limit operator returns up to the specified number of events (or fewer, if fewer events match the query). You can use this operator to size your result sets, and to control resource usage.

Alias: take (limit and take are synonyms).

Syntax ​

Scope | limit Integer

Arguments ​

• Scope: The events to search.
• Integer: A positive integer.

Usage ​

Bear in mind the following execution details:

• limit doesn’t guarantee any consistency in its results when executing multiple times, even if the Dataset hasn’t changed.

• In interactive searches (from the query box), query execution with limit displays previews of the results. These previews reflect only a sample of events, up to the limit threshold.

• Scheduled and programmatic searches omit these previews.

Example ​

dataset=myDataset
| limit 1000

Return only 42 events.

dataset=$vt_dummy event<100 
| extend parity=iif(event%2==0, 'even', 'odd') 
| limit 42