You can specify a limit to the number of events retrieved in a couple of ways: Use the head command. The head command retrieves only the most recent N events for a historical search, or the first N captured events for a realtime search.