You can do it like this:
... | reverse | streamstats current=t count AS SERIAL | where SERIAL > 1 | reverse | fields - SERIAL
Here are the options that you can try is this. Again it depends on what search you're using,( how complex, how big, current performance.
Option 1
Your current search giving N results | head [Your current search again giving N results| stats count | eval count=count-1 | return $count]
Option 2
your current search giving N results | eval sno=1 | accum sno | eventstats max(sno) as max | where max!=son | fields - max,sno
It is max!=sno
, not max!=son
, right?
yeah, it is...you know nothing jon
sno
You can do it like this:
... | reverse | streamstats current=t count AS SERIAL | where SERIAL > 1 | reverse | fields - SERIAL
Had a typo: was SERIAL > 0
but is corrected now to SERIAL > 1
.
Good job man, you rock !
Yes. You solved my issue. Thanks very much.