Ingore last result in timechart

[Ponczi1]

Hello i have a search query with timechart function but i don't want to display last bucket because it shows not complete data.
I use 5m span and i would like to display ONLY the time frames that have completely passed. Is there an easy way to achieve this?

[mayurr98]

can you provide the timechart query that you have?

[bmacias84 · Accepted solution]

Timechart has a command option call partial. By default this is set to true, so set this to false. Only the first and last buckets can be partials. http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Timechart

...| timechart partial=False count by foo

[cmerriman]

this is a bit tedious, but should get you what you need.

....|<timechart>|reverse|streamstats count|search count>1|reverse