Is there an aggregation function (e.g. via stats or chart) that is a sort of combination of last and list? I want to get the 20 most recent occurences of a field, or 20 rand values of a field:
eventtype="WebAnalytics" | stats limited_list(SessionID, 20)
Some how get the first 20 or last 20 session IDs. "top" gets close to it, but I don't necessarily want to use the most commonly occurring fields, so its a type of search I could add in a ... | dedup SessionID | last_list...
found head
and can use this with sort