limit
Use the limit operator when you want to return only the top rows from a dataset, especially in cases where the full result set isn’t necessary.
Usage#
Syntax#
| limit [N]Parameters#
N: The maximum number of rows to return. This must be a non-negative integer.
Returns#
The limit operator returns the top N rows from the input dataset. If fewer than N rows are available, all rows are returned.
When using limit with summarize where the first grouping expression is a time bin, the limit behavior differs: Axiom computes the global top N groups across all time buckets, then limits each time bucket to only include those groups. This can result in more than N total rows. For more information, see summarize.
Use case examples#
In log analysis, you often want to view only the most recent entries, and limit can help narrow the focus on those rows.
Query
['sample-http-logs']
| limit 5Output
| _time | req_duration_ms | id | status | uri | method | geo.city | geo.country |
|---|---|---|---|---|---|---|---|
| 2024-10-17T12:00:00 | 200 | 123 | 200 | /index.html | GET | New York | USA |
| 2024-10-17T11:59:59 | 300 | 124 | 404 | /notfound.html | GET | London | UK |
This query limits the output to the first 5 rows from the ['sample-http-logs'] dataset, returning recent HTTP log entries.
When analyzing OpenTelemetry traces, you may want to focus on the most recent traces.
Query
['otel-demo-traces']
| limit 5Output
| _time | duration | span_id | trace_id | service.name | kind | status_code |
|---|---|---|---|---|---|---|
| 2024-10-17T12:00:00 | 500ms | 1abc | 123xyz | frontend | server | OK |
| 2024-10-17T11:59:59 | 200ms | 2def | 124xyz | cartservice | client | OK |
This query retrieves the first 5 rows from the ['otel-demo-traces'] dataset, helping you analyze the latest traces.
For security log analysis, you might want to review the most recent login attempts to ensure no anomalies exist.
Query
['sample-http-logs']
| where status == '401'
| limit 5Output
| _time | req_duration_ms | id | status | uri | method | geo.city | geo.country |
|---|---|---|---|---|---|---|---|
| 2024-10-17T12:00:00 | 300 | 567 | 401 | /login.html | POST | Berlin | Germany |
| 2024-10-17T11:59:59 | 250 | 568 | 401 | /login.html | POST | Sydney | Australia |
This query limits the output to 5 unauthorized access attempts (401 status code) from the ['sample-http-logs'] dataset.
List of related operators#
- take: Similar to
limit, but explicitly focuses on row sampling. - top: Retrieves the top N rows sorted by a specific field.
- sample: Randomly samples N rows from the dataset.
Other query languages#
Splunk SPL users
In Splunk, the equivalent to APL’s limit is the head command, which also returns the top rows of a dataset. The main difference is in the syntax.
Splunk example
| head 10APL equivalent
['sample-http-logs']
| limit 10ANSI SQL users
In ANSI SQL, the LIMIT clause is equivalent to the limit operator in APL. The SQL LIMIT statement is placed at the end of a query, whereas in APL, the limit operator comes after the dataset reference.
SQL example
SELECT * FROM sample_http_logs LIMIT 10;APL equivalent
['sample-http-logs']
| limit 10