How can I return calculated (variable) number of top events? This doesn't work: ... | eval x=5 | head x
... | eval x=5 | head x
Got it: ... | eval x=5 | streamstats c | where c<=x
... | eval x=5 | streamstats c | where c<=x
View solution in original post