limit

This page explains how to use the limit operator in APL.

The limit operator in Axiom Processing Language (APL) allows you to restrict the number of rows returned from a query. It’s particularly useful when you want to see only a subset of results from large datasets, such as when debugging or previewing query outputs. The limit operator can help optimize performance and focus analysis by reducing the amount of data processed.

Use the limit operator when you want to return only the top rows from a dataset, especially in cases where the full result set isn’t necessary.

Usage

Syntax

APL

| limit [N]

Parameters

N: The maximum number of rows to return. This must be a non-negative integer.

Returns

The limit operator returns the top N rows from the input dataset. If fewer than N rows are available, all rows are returned.

Default and maximum limits

If your query doesn’t contain limit or take, Axiom applies a default limit of 1,000 rows to the query result. To return more rows, add limit to the end of your query and specify a higher value.

In queries where summarize groups by a time bin first, the default limit applies to groups in the same way as described in the note above. This means that the query result can contain more than 1,000 rows without limit.

The maximum value of N is 50,000. If you specify a higher value, Axiom returns a maximum of 50,000 rows.

When a limit truncates the query result, Axiom adds one of the following warnings to the result:

Warning code	Message	Description
`default_limit_warning`	A default limit of 1000 was applied	The query doesn’t specify a limit and has more than 1,000 results. To return more results, add `limit` to the query.
`max_limit_warning`	A maximum limit was applied	The query has more results than the maximum limit allows. To return the remaining results, narrow the time range or the filters of the query, or paginate the query.

Use case examples

In log analysis, you often want to view only the most recent entries, and limit can help narrow the focus on those rows.

Query

APLRun in Playground

['sample-http-logs']
| limit 5

Output

_time	req_duration_ms	id	status	uri	method	geo.city	geo.country
2024-10-17T12:00:00	200	123	200	/index.html	GET	New York	USA
2024-10-17T11:59:59	300	124	404	/notfound.html	GET	London	UK

This query limits the output to the first 5 rows from the ['sample-http-logs'] dataset, returning recent HTTP log entries.

When analyzing OpenTelemetry traces, you may want to focus on the most recent traces.

Query

APLRun in Playground

['otel-demo-traces']
| limit 5

Output

_time	duration	span_id	trace_id	service.name	kind	status_code
2024-10-17T12:00:00	500ms	1abc	123xyz	frontend	server	OK
2024-10-17T11:59:59	200ms	2def	124xyz	cartservice	client	OK

This query retrieves the first 5 rows from the ['otel-demo-traces'] dataset, helping you analyze the latest traces.

For security log analysis, you might want to review the most recent login attempts to ensure no anomalies exist.

Query

APLRun in Playground

['sample-http-logs']
| where status == '401'
| limit 5

Output

_time	req_duration_ms	id	status	uri	method	geo.city	geo.country
2024-10-17T12:00:00	300	567	401	/login.html	POST	Berlin	Germany
2024-10-17T11:59:59	250	568	401	/login.html	POST	Sydney	Australia

This query limits the output to 5 unauthorized access attempts (401 status code) from the ['sample-http-logs'] dataset.

take: Similar to limit, but explicitly focuses on row sampling.
top: Retrieves the top N rows sorted by a specific field.
sample: Randomly samples N rows from the dataset.