Splunk Search

How can I return specific results using head and tail commands?

bbabcock
New Member

I have an alert currently set to return a full set of results based upon the stats command which sometimes might number as many as 30 rows. I would like to split this alert into 3 separate alerts to be emailed. The first will return results 1 through 5. The second 6 through 10. The third will show 11+.

The first alert is easy, I just have to add | head 5 to the end.

The second is where I have problems. The idea is to do something like | head 10 | tail 5, which works great when there are 10 or more results. However it falls apart if there are <10 results. I don't want the same result to be duplicated on multiple alerts. Unfortunately the tail command will not take a variable as an argument so I need to figure out how to pass it an integer based upon the total number of results in the search.

Another post suggested to pass it the results of a subsearch, but I get mixed results. The issue appears to be that the subsearch is evaluating several times as the events are being located and therefore the value keeps changing. The final value is somehow not evaluating to the number that I expect and therefore not executing the tail command properly.

For example, where stats is returning 8 results, this code addition is returning 5 results where I expect 3.

| head 10 
| tail [ | stats count as numrec | eval search=if(numrec < 10, abs( numrec - 5), 5) | fields search ]
| reverse

If there's other methods of achieving what I need, I'm open to ideas.

0 Karma
1 Solution

maciep
Champion

what about using stream stats to essentially create a row number?

... | streamstats count as row_num | where row_num <=5 | fields - row_num
... | streamstats count as row_num | where row_num >5 AND row_num <=10 | fields - row_num
... | streamstats count as row_num | where row_num >10 | fields - row_num

View solution in original post

lquinn
Contributor

I tried the above search and it worked for me. I applied it to 8 results and 3 were returned ...
Have you tried breaking down the subsearch to see if each section is returning what you expect?

0 Karma

bbabcock
New Member

If I output numrec and search to a table, I get 8 and 3 respectively which is what I expect. However, the values change as the events are pouring in and I suspect this is confusing the tail command somehow. Ideally I'd like that subsearch to only run once at the very end. Maciep's solution works a little more gracefully anyways.

0 Karma

maciep
Champion

what about using stream stats to essentially create a row number?

... | streamstats count as row_num | where row_num <=5 | fields - row_num
... | streamstats count as row_num | where row_num >5 AND row_num <=10 | fields - row_num
... | streamstats count as row_num | where row_num >10 | fields - row_num

bbabcock
New Member

Yes, this worked perfectly without having to make major changes to my existing code! Thanks.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...