https://community.splunk.com/t5/Splunk-Search/How-to-display-the-last-value-of-an-event-in-place-of-each-of/m-p/119058#M31900 <P>But It should showing in all the places wherever "-" presents. Plz look it below </P> <PRE><CODE> 1:00 2:00 3:00 4:00 </CODE></PRE> <OL> <LI>foo 100 200 - -</LI> <LI>foo1 - - 50 100</LI> <LI>foo3 50 100 300 -</LI> <LI>foo4 - 50 100 -</LI> </OL> <P>We need to replace "-" with 200 in "1.foo" at time of 3:00 and 4:00and similarly for "3.foo3" should replace 300 at time of 4:00. In 4.foo4 replace 100 at 4:00, not at 1:00</P> <P>I have used filldown, but it is not working. Can someone help me with the search for this?</P> Wed, 15 Jul 2015 05:54:36 GMT kkarthik2 2015-07-15T05:54:36Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-last-value-of-an-event-in-place-of-each-of/m-p/119056#M31898 <P>Example: My dashboard looks like</P> <PRE><CODE> 1:00 2:00 3:00 4:00 1. foo 100 200 - - 2. foo1 - - 50 100 3. foo3 50 100 200 - 4. foo4 - 50 100 200 </CODE></PRE> <P>We need to replace "-" with 200 in "1.foo" and similarly for "3.foo3".</P> <P>I have used filldown, but it is not working. Can someone help me with the search for this?</P> <P>sourcetype="foo" | ....|chart max(S1) as S1 by foo, time | filldown S1.</P> Tue, 14 Jul 2015 09:44:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-last-value-of-an-event-in-place-of-each-of/m-p/119056#M31898 kkarthik2 2015-07-14T09:44:54Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-last-value-of-an-event-in-place-of-each-of/m-p/119057#M31899 <P>You should be able to use the <CODE>fillnull</CODE> command.</P> <PRE><CODE>sorucetype="foo" | ....|chart max(S1) as S1 by foo,time | fillnull value=200 S1 </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/fillnull">http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/fillnull</A></P> Tue, 14 Jul 2015 11:20:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-last-value-of-an-event-in-place-of-each-of/m-p/119057#M31899 alacercogitatus 2015-07-14T11:20:47Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-last-value-of-an-event-in-place-of-each-of/m-p/119058#M31900 <P>But It should showing in all the places wherever "-" presents. Plz look it below </P> <PRE><CODE> 1:00 2:00 3:00 4:00 </CODE></PRE> <OL> <LI>foo 100 200 - -</LI> <LI>foo1 - - 50 100</LI> <LI>foo3 50 100 300 -</LI> <LI>foo4 - 50 100 -</LI> </OL> <P>We need to replace "-" with 200 in "1.foo" at time of 3:00 and 4:00and similarly for "3.foo3" should replace 300 at time of 4:00. In 4.foo4 replace 100 at 4:00, not at 1:00</P> <P>I have used filldown, but it is not working. Can someone help me with the search for this?</P> Wed, 15 Jul 2015 05:54:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-last-value-of-an-event-in-place-of-each-of/m-p/119058#M31900 kkarthik2 2015-07-15T05:54:36Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-last-value-of-an-event-in-place-of-each-of/m-p/119059#M31901 <P>need to show latest value on remaining times for each row, once we get value reaches the target.</P> Wed, 15 Jul 2015 05:56:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-last-value-of-an-event-in-place-of-each-of/m-p/119059#M31901 kkarthik2 2015-07-15T05:56:22Z