Fill field with first value

cxs6345 — Mon, 05 Aug 2024 19:32:59 GMT

I have a data set for web traffic. A sessionID ties all traffic for an individual browsing session together - all events from the time you open a new tab until you close it. There is also a memberID field. Some records do NOT have a value populated for memberID, so I want to return each record for the sessionID with the FIRST non-null value found in the sessionID. For instance

time	sessionID	memberID	evalField
12:01	1	<NULL>	abc
12:02	1	<NULL>	abc
12:03	1	abc	abc
12:04	1	<NULL>	abc

Can someone help me out with how to get this evalField column? Thanks so much!

Re: Fill field with first value

PickleRick — Mon, 05 Aug 2024 21:17:58 GMT

That's job for eventstats.

<your search>
| eventstats first(memberID) as memberID by sessionID

topic Re: Fill field with first value in Splunk Search

Fill field with first value

Re: Fill field with first value