https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-of-one-event-with-another-event/m-p/510572#M142920 <P>I am assuming your example shows the word "Null" as the text value rather than Splunk 'null', so in that case, this is an example where I have shown your data plus a couple of additional games to demonstrate the point.</P><LI-CODE lang="markup">| makeresults | eval _raw="ProductName,categoryId Benign Space Debris,Arcade Orvil The Wolverine,Arcade Some Other Game,Board Another New Game,Null Orvil The Wolverine,Null Another New Game,Ball Benign Space Debris,Null Some Other Game,Null" | multikv forceheader=1 | table ProductName categoryId | rename "COMMENT" as "Above this line is your data setup" | eval categoryId=nullif(categoryId, "Null") | sort ProductName, categoryId | filldown categoryId</LI-CODE><P>This works by ensuring that the text "Null" is converted to a Splunk null and then sorts the data by ProductName and categoryId, which is ensuring that the null entries are at the end of the product name.</P><P>It then uses filldown to take a current categoryId and places it in subsequent null records below.</P><P>Hope this helps.</P><P>&nbsp;</P> Thu, 23 Jul 2020 04:19:41 GMT bowesmana 2020-07-23T04:19:41Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-of-one-event-with-another-event/m-p/510569#M142918 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Annotation 2020-07-23 120100.png" style="width: 720px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/9834i4A5E737797EBCF41/image-size/large?v=v2&amp;px=999" role="button" title="Annotation 2020-07-23 120100.png" alt="Annotation 2020-07-23 120100.png" /></span></P> <P>This is the data set from Fundamental 1.</P> <P>A lot of successful purchase events with same 'ProductName' doesn't include 'categoryId' as a field. So I want to put/replace the null 'categoryId' field with 'categoryId' which have the same 'ProductName'. How do I do it and scale it up to multiple events?</P> <P>For example, I want the Null value in the screenshot above replaced by the categoryId of the same ProductName.</P> <P>I hope I word this out clearly. Thank you in advance.</P> Thu, 23 Jul 2020 05:19:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-of-one-event-with-another-event/m-p/510569#M142918 FaridHamidi 2020-07-23T05:19:28Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-of-one-event-with-another-event/m-p/510572#M142920 <P>I am assuming your example shows the word "Null" as the text value rather than Splunk 'null', so in that case, this is an example where I have shown your data plus a couple of additional games to demonstrate the point.</P><LI-CODE lang="markup">| makeresults | eval _raw="ProductName,categoryId Benign Space Debris,Arcade Orvil The Wolverine,Arcade Some Other Game,Board Another New Game,Null Orvil The Wolverine,Null Another New Game,Ball Benign Space Debris,Null Some Other Game,Null" | multikv forceheader=1 | table ProductName categoryId | rename "COMMENT" as "Above this line is your data setup" | eval categoryId=nullif(categoryId, "Null") | sort ProductName, categoryId | filldown categoryId</LI-CODE><P>This works by ensuring that the text "Null" is converted to a Splunk null and then sorts the data by ProductName and categoryId, which is ensuring that the null entries are at the end of the product name.</P><P>It then uses filldown to take a current categoryId and places it in subsequent null records below.</P><P>Hope this helps.</P><P>&nbsp;</P> Thu, 23 Jul 2020 04:19:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-field-value-of-one-event-with-another-event/m-p/510572#M142920 bowesmana 2020-07-23T04:19:41Z