Splunk Search

only interested in the last line of the table for creating alerts

bowa
Path Finder

I have a savedsearch thats on a dashboard that is run every hour.
It gives a table with or each hour of that day a row with some stats (like the % of slow transactions).

Now i would like to add an alert to this saved search, to be notified if the % of slow transactions is above a certain percentage.

A conditional alert with condition

search slowpct>10

does the trick ... but once we have had an hour with a lot of slow transactions it will always gets triggers.
So i am looking for a way to do this search only on the last row of my table with results so i only get an alert when that line has a slowpct>10 .

1 Solution

Ant1D
Motivator

If you want the search to return the latest (top) row of your table, then add the following pipe after your search: | head 1

If you want the last (bottom) row of your table, then add the follwing pipe after your search:
| tail 1

View solution in original post

0 Karma

Ant1D
Motivator

If you want the search to return the latest (top) row of your table, then add the following pipe after your search: | head 1

If you want the last (bottom) row of your table, then add the follwing pipe after your search:
| tail 1

0 Karma

Ant1D
Motivator

No problem, it's a useful question

0 Karma

bowa
Path Finder

duh ... now i feel stupid :$

Thanks 🙂

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...