topic Re: How to delete last row in a table? in Splunk Search

How to delete last row in a table?

Kirthika — Thu, 25 May 2023 12:09:01 GMT

Count	error_manager
1	System
2	System
3	System
4	System
5	System
6	System

How to delete last row in a table?

Re: delete last row in a table

BrodyT — Thu, 25 May 2023 10:57:58 GMT

Count	error_manager
1	System
2	System
3	System
4	System
5	System

Re: delete last row in a table

Kirthika — Thu, 25 May 2023 10:59:39 GMT

We need to remove last row. It shouldn't be based on value.

Re: delete last row in a table

BrodyT — Thu, 25 May 2023 11:10:32 GMT

@Kirthika

This will eliminate the last result assuming your data is in descending order of Count

Re: delete last row in a table

ITWhisperer — Thu, 25 May 2023 11:43:32 GMT

Note the use of lowercase for the count field - if this clashes with your existing field names use alternative names e.g. streamstats count as row etc.

| streamstats count | eventstats count as total | where count != total | fields - count total

Re: How to delete last row in a table?

yuanliu — Mon, 29 May 2023 04:36:14 GMT

Based on the layout, I hypothesize that the count column is in ascending order. If it is so, find the maximum then compare each row with it.

| eventstats max(Count) as maxcount | where Count < maxcount