search by linecount last 1 million lines.

[levent_kurt]

how can i search only last 1 million lines of 4 million lined total log file?

[Ayn · Accepted solution]

Assuming each line in the log file is treated as one event in Splunk:

source="yoursource" | head 1000000