Splunk Search

only interested in the last line of the table for creating alerts

bowa
Path Finder

I have a savedsearch thats on a dashboard that is run every hour.
It gives a table with or each hour of that day a row with some stats (like the % of slow transactions).

Now i would like to add an alert to this saved search, to be notified if the % of slow transactions is above a certain percentage.

A conditional alert with condition

search slowpct>10

does the trick ... but once we have had an hour with a lot of slow transactions it will always gets triggers.
So i am looking for a way to do this search only on the last row of my table with results so i only get an alert when that line has a slowpct>10 .

1 Solution

Ant1D
Motivator

If you want the search to return the latest (top) row of your table, then add the following pipe after your search: | head 1

If you want the last (bottom) row of your table, then add the follwing pipe after your search:
| tail 1

View solution in original post

0 Karma

Ant1D
Motivator

If you want the search to return the latest (top) row of your table, then add the following pipe after your search: | head 1

If you want the last (bottom) row of your table, then add the follwing pipe after your search:
| tail 1

0 Karma

Ant1D
Motivator

No problem, it's a useful question

0 Karma

bowa
Path Finder

duh ... now i feel stupid :$

Thanks 🙂

Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...