Axiom
Overview

take

Usage#

Syntax#

| take N

Parameters#

  • N: The number of rows to take from the dataset. N must be a positive integer.

Returns#

The operator returns the specified number of rows from the dataset.

Use case examples#

The take operator is useful in log analysis when you need to view a subset of logs to quickly identify trends or errors without analyzing the entire dataset.

Query

['sample-http-logs']
| take 5

Run in Playground

Output

_time req_duration_ms id status uri method geo.city geo.country
2023-10-18T10:00:00Z 120 u123 200 /home GET Berlin Germany
2023-10-18T10:01:00Z 85 u124 404 /login POST New York USA
2023-10-18T10:02:00Z 150 u125 500 /checkout POST Tokyo Japan

This query retrieves the first 5 rows from the sample-http-logs dataset.

In the context of OpenTelemetry traces, the take operator helps extract a small number of traces to analyze span performance or trace behavior across services.

Query

['otel-demo-traces']
| take 3

Run in Playground

Output

_time duration span_id trace_id service.name kind status_code
2023-10-18T10:10:00Z 250ms s123 t456 frontend server OK
2023-10-18T10:11:00Z 300ms s124 t457 checkoutservice client OK
2023-10-18T10:12:00Z 100ms s125 t458 cartservice internal ERROR

This query retrieves the first 3 spans from the OpenTelemetry traces dataset.

For security logs, take allows quick sampling of log entries to detect patterns or anomalies without needing the entire log file.

Query

['sample-http-logs']
| take 10

Run in Playground

Output

_time req_duration_ms id status uri method geo.city geo.country
2023-10-18T10:20:00Z 200 u223 200 /admin GET London UK
2023-10-18T10:21:00Z 190 u224 403 /dashboard GET Berlin Germany

This query retrieves the first 10 security log entries, useful for quick investigations.

  • limit: Similar to take, but explicitly limits the result set and often used for pagination or performance optimization.
  • sort: Used in combination with take when you want to fetch a subset of sorted data.
  • where: Filters rows based on a condition before using take for sampling specific subsets.

Other query languages#

Splunk SPL users

In Splunk SPL, the head and tail commands perform similar operations to the APL take operator, where head returns the first N results, and tail returns the last N. In APL, take is a flexible way to fetch any subset of rows in a dataset.

Splunk example

| head 10

APL equivalent

['sample-http-logs']
| take 10
ANSI SQL users

In ANSI SQL, the equivalent of the APL take operator is LIMIT. While SQL requires you to specify a sorting order with ORDER BY for deterministic results, APL allows you to use take to fetch a specific number of rows without needing explicit sorting.

SQL example

SELECT * FROM sample_http_logs LIMIT 10;

APL equivalent

['sample-http-logs']
| take 10

Updated

Was this page helpful?