Splunk Search

How to write a search to not display the last bucket of data in a timechart?

ID_SplunkUser
Path Finder

I have a requirement in which I don't want to display the last bucket of data in the timechart.
Example: The bucket timespan is 5m. If I open my Dashboard at 11:02 am, the last bucket will contain data for only 2 minutes. I don't want to display this data in timechart.
Is there anyway to remove this last bucket data?

bandit
Motivator

If the goal is not to show partial/incomplete buckets in you timechart, this option should work for your use case, partial=false.

| timechart partial=false

woodcock
Esteemed Legend

Tack this onto your existing search:

... | eventstats max(_time) AS maxTime | where _time < maxTime | fields - maxTime

bandit
Motivator

Thanks, @woodcock. Here's a variation to drop both first and last buckets.

| eventstats min(_time) as minTime max(_time) as maxTime 
| where _time > minTime AND _time < maxTime
| fields - minTime, maxTime 
0 Karma

ID_SplunkUser
Path Finder

Thanks for replying. But it's not working & last bucket data is still shown in timechart.

0 Karma

woodcock
Esteemed Legend

I tested it before I posted; it DEFINITELY works. If it is not working for you, then I will need to see your actual search which must be doing something unusual.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...