Splunk Search

How to print results excluding the last line in Splunk like "head -n -1" in LInux?

perlish
Communicator

Hi all,

I want to print results excluding the last line.
In Linux, I can use head -n -1
but in Splunk, the head command only accepts positive numbers.

Tags (2)
1 Solution

woodcock
Esteemed Legend

You can do it like this:

... | reverse | streamstats current=t count AS SERIAL | where SERIAL > 1 | reverse | fields - SERIAL

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Here are the options that you can try is this. Again it depends on what search you're using,( how complex, how big, current performance.

Option 1

Your current search giving N results | head [Your current search again giving N results| stats count | eval count=count-1 | return $count]

Option 2

your current search giving N results | eval sno=1 | accum sno | eventstats max(sno) as max | where max!=son | fields - max,sno
0 Karma

woodcock
Esteemed Legend

It is max!=sno, not max!=son, right?

0 Karma

DavidHourani
Super Champion

yeah, it is...you know nothing jon sno

0 Karma

woodcock
Esteemed Legend

You can do it like this:

... | reverse | streamstats current=t count AS SERIAL | where SERIAL > 1 | reverse | fields - SERIAL

woodcock
Esteemed Legend

Had a typo: was SERIAL > 0 but is corrected now to SERIAL > 1.

0 Karma

DavidHourani
Super Champion

Good job man, you rock !

0 Karma

perlish
Communicator

Yes. You solved my issue. Thanks very much.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...