Splunk Search

How to write a search to not display the last bucket of data in a timechart?

ID_SplunkUser
Path Finder

I have a requirement in which I don't want to display the last bucket of data in the timechart.
Example: The bucket timespan is 5m. If I open my Dashboard at 11:02 am, the last bucket will contain data for only 2 minutes. I don't want to display this data in timechart.
Is there anyway to remove this last bucket data?

bandit
Motivator

If the goal is not to show partial/incomplete buckets in you timechart, this option should work for your use case, partial=false.

| timechart partial=false

woodcock
Esteemed Legend

Tack this onto your existing search:

... | eventstats max(_time) AS maxTime | where _time < maxTime | fields - maxTime

bandit
Motivator

Thanks, @woodcock. Here's a variation to drop both first and last buckets.

| eventstats min(_time) as minTime max(_time) as maxTime 
| where _time > minTime AND _time < maxTime
| fields - minTime, maxTime 
0 Karma

ID_SplunkUser
Path Finder

Thanks for replying. But it's not working & last bucket data is still shown in timechart.

0 Karma

woodcock
Esteemed Legend

I tested it before I posted; it DEFINITELY works. If it is not working for you, then I will need to see your actual search which must be doing something unusual.

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...