Is there any way to limit the number of search results in a data model?

[emiliavanderwer]

When searching on an index, you can pipe to "head 100" and retrieve 100 results.

index=my_index cookie* | head 100

However, when searching over a data model, how do you tell it to get only 100 results?

| tstats count from datamodel=my_dm where g.message=cookie* by g.id

[woodcock]

The exact same way:

| tstats count from datamodel=my_dm where g.message=cookie* by g.id | head 100

Or, more productively,

| tstats count from datamodel=my_dm where g.message=cookie* by g.id | sort 100 - count

[renjith_nair · Accepted solution]

@emiliavanderwerf,

Did you try

| tstats count from datamodel=my_dm where g.message=cookie* by g.id|head 100

Below works for me

|tstats count from datamodel=test by sourcetype|head 2

Where test is index=_internal