Splunk Search

only interested in the last line of the table for creating alerts

bowa
Path Finder

I have a savedsearch thats on a dashboard that is run every hour.
It gives a table with or each hour of that day a row with some stats (like the % of slow transactions).

Now i would like to add an alert to this saved search, to be notified if the % of slow transactions is above a certain percentage.

A conditional alert with condition

search slowpct>10

does the trick ... but once we have had an hour with a lot of slow transactions it will always gets triggers.
So i am looking for a way to do this search only on the last row of my table with results so i only get an alert when that line has a slowpct>10 .

1 Solution

Ant1D
Motivator

If you want the search to return the latest (top) row of your table, then add the following pipe after your search: | head 1

If you want the last (bottom) row of your table, then add the follwing pipe after your search:
| tail 1

View solution in original post

0 Karma

Ant1D
Motivator

If you want the search to return the latest (top) row of your table, then add the following pipe after your search: | head 1

If you want the last (bottom) row of your table, then add the follwing pipe after your search:
| tail 1

0 Karma

Ant1D
Motivator

No problem, it's a useful question

0 Karma

bowa
Path Finder

duh ... now i feel stupid :$

Thanks 🙂

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...