Dashboards & Visualizations

How do you automatically remove the last entry in a table?

Hppjet
Path Finder

I am doing a time chart but I don't want Today's date to show in the table. I know I can do that with the date range but that is cumbersome.

Any way to write it in SPL to do this?

Tags (1)
0 Karma
1 Solution

Hppjet
Path Finder

| table _time SQYDLBHR
| streamstats count(SQYDLBHR) as timerange
| eventstats count(SQYDLBHR) as this
| eval Number = this - 1
| head (timerange

View solution in original post

RobertCh
Loves-to-Learn

Old post but posting response in case anyone finds this.

 

I was able to accomplish this by doing the following.

| streamstats count(latest_requests) as timerange
| where (timerange > 1)

 

0 Karma

Hppjet
Path Finder

| table _time SQYDLBHR
| streamstats count(SQYDLBHR) as timerange
| eventstats count(SQYDLBHR) as this
| eval Number = this - 1
| head (timerange

Hppjet
Path Finder

| table _time SQYDLBHR
| streamstats count(SQYDLBHR) as timerange
| eventstats count(SQYDLBHR) as this
| eval Number = this - 1
| head (timerange

0 Karma

Hppjet
Path Finder

It keeps failing the last line to display but it is | head (timerange < Number)

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@Hppjet,

Does this suit your requirement?

|where strftime(_time,"%d-%m-%Y")!=strftime(now(),"%d-%m-%Y")
Happy Splunking!
0 Karma

tom_frotscher
Builder

Hi,

maybe the partial option of the timechart command can help you out. It basically dismisses all bins that are partial. Which in your case should drop the last day, since it is not completed until midnight. Only the first and the last bin can be partial, so you might also lose the first bin.

http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Timechart#Optional_arguments

Ofcourse you can also do some streamstats count magic and create a field that simply counts and combine it with | search count != 1.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...