Splunk Search

How to edit my search to get the last N transactions since current time?

gregory_geller
Engager

I have defined a transaction based on a JobID and I want to list the last N transactions. How can I do this??

sourcetype=stomp | transaction field-list jobID startswith=(eventtype=Begin) endswith=(eventtype=End) unifyends=true

What I eventually want to do is track some stats over time for the last 10 transactions. For example, total number of bytes copied, average data rate, etc.

Thank you!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You can use tail command to get the last N events from your search. So try something like this

sourcetype=stomp | transaction field-list jobID startswith=(eventtype=Begin) endswith=(eventtype=End) unifyends=true | tail 10 | ...your aggregation commans on these 10 results...

Update

Need to "head" instead of "tail" here as Splunk events are sorted reverse chronological.

sourcetype=stomp | transaction field-list jobID startswith=(eventtype=Begin) endswith=(eventtype=End) unifyends=true | head 10 | ...your aggregation commans on these 10 results...

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

You can use tail command to get the last N events from your search. So try something like this

sourcetype=stomp | transaction field-list jobID startswith=(eventtype=Begin) endswith=(eventtype=End) unifyends=true | tail 10 | ...your aggregation commans on these 10 results...

Update

Need to "head" instead of "tail" here as Splunk events are sorted reverse chronological.

sourcetype=stomp | transaction field-list jobID startswith=(eventtype=Begin) endswith=(eventtype=End) unifyends=true | head 10 | ...your aggregation commans on these 10 results...

gregory_geller
Engager

Thanks. That got me there, although what I want is head 10, not tail. Tail gave me the oldest 10 transactions instead of the newest.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Yup... Got confused with "Last" word. I've been using UNIX tail command to get the last 5 lines almost whole day today. Updated the answer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...