Can you skip the first x rows returned in a search?

[ewanbrown]

Hi,

If I have a query which returns 100 rows I'd like to be able to only get rows 11-100 shown (and if 200 only rows 11-200)

I have looked for an offset command similar to head or tail but I can't see one. Do you know how I could go about this?

Thanks

[harishalipaka]

hi @ewanbrown

just add this end of your query : |streamstats count as result |where result >10

[ewanbrown]

Thanks! That works

[harishalipaka · Accepted solution]

hi @ewanbrown

try like this

| makeresults 
 | fields - _time 
 | eval data="A1 A2 A3 A4 A5 A6 A7 A8 A9 A10 A11 A12 A13 A14 A15 A16 A17 A18" 
 | makemv data delim=";" 
 | mvexpand data 
 | makemv data delim=" " | mvexpand data |streamstats count as result |where result >10 |fields - result

[adonio]

nice idea @harishalipaka!