Hello, i'm trying to run a query but I would like it to stop at the first 10,000 events and I don't mean to display the first 10,000 events. The issue is that I'm building a front end for errors and if a user chooses errors in the last 10 minutes, there could be 100,000 and "head" or "streamstats count" will display the first 10,000 but the query continues to run in the background. I want the query to stop once it hits 10,000 events. Does anyone know of a way to accomplish this?
| streamstats count | where count<=10000 will display 10000 but give me 13,887 events (7/25/18 8:54:27.000 AM to 7/25/18 8:59:27.000 AM)
| head 10000 does the same
↧