Splunk Search

only interested in the last line of the table for creating alerts

bowa
Path Finder

I have a savedsearch thats on a dashboard that is run every hour.
It gives a table with or each hour of that day a row with some stats (like the % of slow transactions).

Now i would like to add an alert to this saved search, to be notified if the % of slow transactions is above a certain percentage.

A conditional alert with condition

search slowpct>10

does the trick ... but once we have had an hour with a lot of slow transactions it will always gets triggers.
So i am looking for a way to do this search only on the last row of my table with results so i only get an alert when that line has a slowpct>10 .

1 Solution

Ant1D
Motivator

If you want the search to return the latest (top) row of your table, then add the following pipe after your search: | head 1

If you want the last (bottom) row of your table, then add the follwing pipe after your search:
| tail 1

View solution in original post

0 Karma

Ant1D
Motivator

If you want the search to return the latest (top) row of your table, then add the following pipe after your search: | head 1

If you want the last (bottom) row of your table, then add the follwing pipe after your search:
| tail 1

0 Karma

Ant1D
Motivator

No problem, it's a useful question

0 Karma

bowa
Path Finder

duh ... now i feel stupid :$

Thanks 🙂

Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...