https://community.splunk.com/t5/Splunk-Search/only-interested-in-the-last-line-of-the-table-for-creating/m-p/103873#M26867 <P>I have a savedsearch thats on a dashboard that is run every hour.<BR /> It gives a table with or each hour of that day a row with some stats (like the % of slow transactions).</P> <P>Now i would like to add an alert to this saved search, to be notified if the % of slow transactions is above a certain percentage.</P> <P>A conditional alert with condition</P> <PRE><CODE>search slowpct&gt;10 </CODE></PRE> <P>does the trick ... but once we have had an hour with a lot of slow transactions it will always gets triggers.<BR /> So i am looking for a way to do this search only on the last row of my table with results so i only get an alert when that line has a slowpct&gt;10 .</P> Wed, 18 May 2011 10:34:25 GMT bowa 2011-05-18T10:34:25Z https://community.splunk.com/t5/Splunk-Search/only-interested-in-the-last-line-of-the-table-for-creating/m-p/103873#M26867 <P>I have a savedsearch thats on a dashboard that is run every hour.<BR /> It gives a table with or each hour of that day a row with some stats (like the % of slow transactions).</P> <P>Now i would like to add an alert to this saved search, to be notified if the % of slow transactions is above a certain percentage.</P> <P>A conditional alert with condition</P> <PRE><CODE>search slowpct&gt;10 </CODE></PRE> <P>does the trick ... but once we have had an hour with a lot of slow transactions it will always gets triggers.<BR /> So i am looking for a way to do this search only on the last row of my table with results so i only get an alert when that line has a slowpct&gt;10 .</P> Wed, 18 May 2011 10:34:25 GMT https://community.splunk.com/t5/Splunk-Search/only-interested-in-the-last-line-of-the-table-for-creating/m-p/103873#M26867 bowa 2011-05-18T10:34:25Z https://community.splunk.com/t5/Splunk-Search/only-interested-in-the-last-line-of-the-table-for-creating/m-p/103874#M26868 <P>If you want the search to return the latest (top) row of your table, then add the following pipe after your search: <CODE>| head 1</CODE></P> <P>If you want the last (bottom) row of your table, then add the follwing pipe after your search:<BR /> <CODE>| tail 1</CODE></P> Wed, 18 May 2011 11:45:15 GMT https://community.splunk.com/t5/Splunk-Search/only-interested-in-the-last-line-of-the-table-for-creating/m-p/103874#M26868 Ant1D 2011-05-18T11:45:15Z https://community.splunk.com/t5/Splunk-Search/only-interested-in-the-last-line-of-the-table-for-creating/m-p/103875#M26869 <P>duh ... now i feel stupid :$</P> <P>Thanks <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 18 May 2011 11:48:21 GMT https://community.splunk.com/t5/Splunk-Search/only-interested-in-the-last-line-of-the-table-for-creating/m-p/103875#M26869 bowa 2011-05-18T11:48:21Z https://community.splunk.com/t5/Splunk-Search/only-interested-in-the-last-line-of-the-table-for-creating/m-p/103876#M26870 <P>No problem, it's a useful question</P> Wed, 18 May 2011 11:55:08 GMT https://community.splunk.com/t5/Splunk-Search/only-interested-in-the-last-line-of-the-table-for-creating/m-p/103876#M26870 Ant1D 2011-05-18T11:55:08Z