Unable to search for the first 10,000 event only

[gferreira]

Hello, i'm trying to run a query but I would like it to stop at the first 10,000 events and I don't mean to display the first 10,000 events. The issue is that I'm building a front end for errors and if a user chooses errors in the last 10 minutes, there could be 100,000 and "head" or "streamstats count" will display the first 10,000 but the query continues to run in the background. I want the query to stop once it hits 10,000 events. Does anyone know of a way to accomplish this?

| streamstats count | where count<=10000 will display 10000 but give me 13,887 events (7/25/18 8:54:27.000 AM to 7/25/18 8:59:27.000 AM)
| head 10000 does the same

[adonio]

hello there,
use | head 10000 before any stats or streamstats or anything
... your search ... | head 10000 | ... more stuff tat you want ...

[sudosplunk]

Can you provide some more information like screenshots of your search and results. The reason I ask is, head command is working perfectly for me. my search | head 10000 stops running as soon as it hits 10k results.