Splunk Search

How to write a search to not display the last bucket of data in a timechart?

ID_SplunkUser
Path Finder

I have a requirement in which I don't want to display the last bucket of data in the timechart.
Example: The bucket timespan is 5m. If I open my Dashboard at 11:02 am, the last bucket will contain data for only 2 minutes. I don't want to display this data in timechart.
Is there anyway to remove this last bucket data?

bandit
Motivator

If the goal is not to show partial/incomplete buckets in you timechart, this option should work for your use case, partial=false.

| timechart partial=false

woodcock
Esteemed Legend

Tack this onto your existing search:

... | eventstats max(_time) AS maxTime | where _time < maxTime | fields - maxTime

bandit
Motivator

Thanks, @woodcock. Here's a variation to drop both first and last buckets.

| eventstats min(_time) as minTime max(_time) as maxTime 
| where _time > minTime AND _time < maxTime
| fields - minTime, maxTime 
0 Karma

ID_SplunkUser
Path Finder

Thanks for replying. But it's not working & last bucket data is still shown in timechart.

0 Karma

woodcock
Esteemed Legend

I tested it before I posted; it DEFINITELY works. If it is not working for you, then I will need to see your actual search which must be doing something unusual.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...