https://community.splunk.com/t5/Splunk-Search/How-to-fill-empty-fields-with-data-from-a-specific-event-field/m-p/445498#M126372 <PRE><CODE>Date...............Time.....................UserID.........................Function.....Main...Sub...Serie...Type 20190312 15:42:16:497 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... 6 T 20190312 15:44:51:391 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:00:656 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:19:740 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:27:327 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:44:393 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:55:946 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:57:353 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:59:196 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:46:00:853 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:46:02:806 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:46:31:491 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... All All 20190312 15:47:12:850 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:47:17:915 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:47:21:400 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:47:22:788 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:47:26:069 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:47:28:866 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:47:32:256 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 </CODE></PRE> <P>I want to fill empty fields "Serie" and "Type" with previous "Serie" and Type" from [Function 1], so the results should be something like this:</P> <PRE><CODE>20190312 15:42:16:497 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... 6 T 20190312 15:44:51:391 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:00:656 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:19:740 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:27:327 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:44:393 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:55:946 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:57:353 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:59:196 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:46:00:853 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:46:02:806 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:46:31:491 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... All All 20190312 15:47:12:850 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All 20190312 15:47:17:915 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All 20190312 15:47:21:400 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All 20190312 15:47:22:788 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All 20190312 15:47:26:069 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All 20190312 15:47:28:866 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All 20190312 15:47:32:256 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All </CODE></PRE> <P>Or add a new field with eval:</P> <PRE><CODE>20190312 15:42:16:497 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... 6 T .... .... 20190312 15:44:51:391 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:00:656 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:19:740 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:27:327 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:44:393 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:55:946 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:57:353 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:59:196 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:46:00:853 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:46:02:806 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:46:31:491 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... All All .... .... 20190312 15:47:12:850 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All 20190312 15:47:17:915 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All 20190312 15:47:21:400 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All 20190312 15:47:22:788 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All 20190312 15:47:26:069 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All 20190312 15:47:28:866 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All 20190312 15:47:32:256 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All </CODE></PRE> <P>Thanks in advance!</P> Wed, 20 Mar 2019 13:46:14 GMT jyab6z 2019-03-20T13:46:14Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-empty-fields-with-data-from-a-specific-event-field/m-p/445498#M126372 <PRE><CODE>Date...............Time.....................UserID.........................Function.....Main...Sub...Serie...Type 20190312 15:42:16:497 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... 6 T 20190312 15:44:51:391 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:00:656 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:19:740 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:27:327 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:44:393 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:55:946 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:57:353 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:45:59:196 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:46:00:853 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:46:02:806 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:46:31:491 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... All All 20190312 15:47:12:850 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:47:17:915 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:47:21:400 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:47:22:788 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:47:26:069 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:47:28:866 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 20190312 15:47:32:256 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 </CODE></PRE> <P>I want to fill empty fields "Serie" and "Type" with previous "Serie" and Type" from [Function 1], so the results should be something like this:</P> <PRE><CODE>20190312 15:42:16:497 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... 6 T 20190312 15:44:51:391 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:00:656 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:19:740 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:27:327 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:44:393 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:55:946 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:57:353 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:45:59:196 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:46:00:853 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:46:02:806 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T 20190312 15:46:31:491 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... All All 20190312 15:47:12:850 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All 20190312 15:47:17:915 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All 20190312 15:47:21:400 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All 20190312 15:47:22:788 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All 20190312 15:47:26:069 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All 20190312 15:47:28:866 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All 20190312 15:47:32:256 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All </CODE></PRE> <P>Or add a new field with eval:</P> <PRE><CODE>20190312 15:42:16:497 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... 6 T .... .... 20190312 15:44:51:391 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:00:656 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:19:740 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:27:327 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:44:393 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:55:946 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:57:353 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:45:59:196 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:46:00:853 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:46:02:806 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T 20190312 15:46:31:491 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... All All .... .... 20190312 15:47:12:850 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All 20190312 15:47:17:915 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All 20190312 15:47:21:400 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All 20190312 15:47:22:788 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All 20190312 15:47:26:069 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All 20190312 15:47:28:866 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All 20190312 15:47:32:256 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All </CODE></PRE> <P>Thanks in advance!</P> Wed, 20 Mar 2019 13:46:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-empty-fields-with-data-from-a-specific-event-field/m-p/445498#M126372 jyab6z 2019-03-20T13:46:14Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-empty-fields-with-data-from-a-specific-event-field/m-p/445499#M126373 <P>Hi</P> <P>Try this</P> <PRE><CODE>your query...| sort Time | streamstats last(Serie) as Serie, last(Type) as Type | table Date,Time,UserID,Function,Main,Sub,Serie,Type </CODE></PRE> Wed, 20 Mar 2019 14:25:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-empty-fields-with-data-from-a-specific-event-field/m-p/445499#M126373 vnravikumar 2019-03-20T14:25:24Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-empty-fields-with-data-from-a-specific-event-field/m-p/445500#M126374 <P>Thanks! It works! </P> Wed, 20 Mar 2019 14:37:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-empty-fields-with-data-from-a-specific-event-field/m-p/445500#M126374 jyab6z 2019-03-20T14:37:35Z