Problem of choosing the line number from a report

[abhayneilam]

Hi,

I have a report generated by SPLUNK , but I want to remove the first 5 lines and rest of the lines will be my output, how Do I do that, I am doing the following :

I am taking the count first, how many lines are there in the file ( Ex:- 1000 )
Then I am doing 1000-5=995 and Then ...|tail 995

But this is no feasible( what will happen if count is too huge and in the generic case )

Please help me regarding this , also if I want to fetch the record such as record no 10 to 20 , then what should be done.. we have kind of "sed" command in Shell Scripting to do that

Please help

[martin_mueller · Accepted solution]

One way to achieve arbitrary selection of rows from your report would be to number them with streamstats and then filter based on the row number. Together with the count of rows you should be able to remove specific row counts from either end, or cut out windows like your 10 to 20.

[Ayn]

Yes, it does. That's why martin had it as the first command in his example. That was only an EXAMPLE - you need to tailor this to your situation.

[abhayneilam]

it is working fine thanks , but "gentimes" is not working, it is saying "gentimes" must be the first command ..

[abhayneilam]

yaa I had a look at "steamstats" docs, but it wasn't that much clear, lemme try out this one...

[Ayn]

Did you look at the streamstats docs?

[martin_mueller]

Consider this "report":

| gentimes start=-1 increment=5m | streamstats count as row | eventstats count as total

It has two relevant fields, row and total, based on those two you can specify loads of conditions. For example, if you want to have all the lines from row 3 on you do this:

... | where row >= 3

If you want to have rows 10 through 20 you do this:

... | where row >= 10 AND row <= 20

If you want the bottom 10 rows you do this:

... | where (total - row) <= 10

[abhayneilam]

Can I please have one small example how to do that ?

lets say I have an output

1 A
2 B
3 C
4 D
5 E
I want to display fron 3 C to End , but I dont know the total lines of a file

Please help with this example