Dashboards & Visualizations

How do you automatically remove the last entry in a table?

Hppjet
Path Finder

I am doing a time chart but I don't want Today's date to show in the table. I know I can do that with the date range but that is cumbersome.

Any way to write it in SPL to do this?

Tags (1)
0 Karma
1 Solution

Hppjet
Path Finder

| table _time SQYDLBHR
| streamstats count(SQYDLBHR) as timerange
| eventstats count(SQYDLBHR) as this
| eval Number = this - 1
| head (timerange

View solution in original post

RobertCh
Loves-to-Learn Lots

Old post but posting response in case anyone finds this.

 

I was able to accomplish this by doing the following.

| streamstats count(latest_requests) as timerange
| where (timerange > 1)

 

0 Karma

Hppjet
Path Finder

| table _time SQYDLBHR
| streamstats count(SQYDLBHR) as timerange
| eventstats count(SQYDLBHR) as this
| eval Number = this - 1
| head (timerange

Hppjet
Path Finder

| table _time SQYDLBHR
| streamstats count(SQYDLBHR) as timerange
| eventstats count(SQYDLBHR) as this
| eval Number = this - 1
| head (timerange

0 Karma

Hppjet
Path Finder

It keeps failing the last line to display but it is | head (timerange < Number)

0 Karma

renjith_nair
Legend

@Hppjet,

Does this suit your requirement?

|where strftime(_time,"%d-%m-%Y")!=strftime(now(),"%d-%m-%Y")
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma

tom_frotscher
Builder

Hi,

maybe the partial option of the timechart command can help you out. It basically dismisses all bins that are partial. Which in your case should drop the last day, since it is not completed until midnight. Only the first and the last bin can be partial, so you might also lose the first bin.

http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Timechart#Optional_arguments

Ofcourse you can also do some streamstats count magic and create a field that simply counts and combine it with | search count != 1.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...