topic Re: How do you automatically remove the last entry in a table? in Dashboards & Visualizations

How do you automatically remove the last entry in a table?

Hppjet — Wed, 10 Oct 2018 14:31:01 GMT

I am doing a time chart but I don't want Today's date to show in the table. I know I can do that with the date range but that is cumbersome.

Any way to write it in SPL to do this?

Re: How do you automatically remove the last entry in a table?

tom_frotscher — Wed, 10 Oct 2018 15:02:22 GMT

Hi,

maybe the partial option of the timechart command can help you out. It basically dismisses all bins that are partial. Which in your case should drop the last day, since it is not completed until midnight. Only the first and the last bin can be partial, so you might also lose the first bin.

http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Timechart#Optional_arguments

Ofcourse you can also do some streamstats count magic and create a field that simply counts and combine it with | search count != 1.

Re: How do you automatically remove the last entry in a table?

renjith_nair — Wed, 10 Oct 2018 15:32:21 GMT

@Hppjet,

Does this suit your requirement?

|where strftime(_time,"%d-%m-%Y")!=strftime(now(),"%d-%m-%Y")

Re: How do you automatically remove the last entry in a table?

Hppjet — Wed, 10 Oct 2018 15:33:21 GMT

Re: How do you automatically remove the last entry in a table?

Hppjet — Wed, 10 Oct 2018 15:35:05 GMT

Re: How do you automatically remove the last entry in a table?

Hppjet — Wed, 10 Oct 2018 15:35:35 GMT

It keeps failing the last line to display but it is | head (timerange < Number)

Re: How do you automatically remove the last entry in a table?

RobertCh — Wed, 12 Jan 2022 16:50:39 GMT

Old post but posting response in case anyone finds this.

I was able to accomplish this by doing the following.

| streamstats count(latest_requests) as timerange | where (timerange > 1)