https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-fill-null-values-with-the-last-known-field/m-p/248544#M74210 <P>That worked.</P> Thu, 07 Jul 2016 19:01:42 GMT jtuni 2016-07-07T19:01:42Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-fill-null-values-with-the-last-known-field/m-p/248540#M74206 <P>I have log data that doesn't always contain a user ID, but I would like to fill the user ID field with the last known user ID. I am using the streamstats command successfully to do this, but only AFTER there is a user ID to associate to the data. What I would like to do is to take that association and apply it to events that were reviewed prior to that association.</P> <P>event logs look something like this</P> <P>ip=1.1.1.1 url=answers.splunk.com<BR /> ip=1.1.1.1 url=answers.splunk.com<BR /> ip=1.1.1.1 userid=user1 url=answers.splunk.com<BR /> ip=1.1.1.1 url=answers.splunk.com<BR /> ip=2.2.2.2 url=answers.splunk.com<BR /> ip=2.2.2.2 userid=user2 url=answers.splunk.com<BR /> ip=2.2.2.2 url=answers.splunk.com</P> <P>My search is this:</P> <PRE><CODE>search url=answers.splunk.com | streamstats current=f window=0 global=f last(userid) as last_userid by ip | stats count by last_userid, ip, url </CODE></PRE> <P>and my results would be</P> <PRE><CODE>last_userid ip url count user1 1.1.1.1 answers.splunk.com 2 user2 2.2.2.2 answers.splunk.com 2 </CODE></PRE> <P>and the results that were prior to the first event log with a userid in it don't get calculated into the result. I need to associated the userid to those events as well.</P> Thu, 07 Jul 2016 18:19:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-fill-null-values-with-the-last-known-field/m-p/248540#M74206 jtuni 2016-07-07T18:19:41Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-fill-null-values-with-the-last-known-field/m-p/248541#M74207 <P>Try <CODE>filldown</CODE> command <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Filldown">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Filldown</A></P> <PRE><CODE>... | filldown user_id | ... </CODE></PRE> <P>If that doesn't work, try <CODE>eventstats</CODE></P> Thu, 07 Jul 2016 18:43:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-fill-null-values-with-the-last-known-field/m-p/248541#M74207 sundareshr 2016-07-07T18:43:39Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-fill-null-values-with-the-last-known-field/m-p/248542#M74208 <P>With this works for you</P> <PRE><CODE>search url=answers.splunk.com | eventstats values(userid) as last_userid by ip | stats count by last_userid, ip, url </CODE></PRE> Thu, 07 Jul 2016 18:53:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-fill-null-values-with-the-last-known-field/m-p/248542#M74208 somesoni2 2016-07-07T18:53:00Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-fill-null-values-with-the-last-known-field/m-p/248543#M74209 <P>I did not try the filldown command. I'm not sure if that will work, but I will try using it to see what sort of results I do get from it. However using eventstats instead of streamstats resolved my issue, thanks.</P> Thu, 07 Jul 2016 19:01:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-fill-null-values-with-the-last-known-field/m-p/248543#M74209 jtuni 2016-07-07T19:01:20Z https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-fill-null-values-with-the-last-known-field/m-p/248544#M74210 <P>That worked.</P> Thu, 07 Jul 2016 19:01:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-dynamically-fill-null-values-with-the-last-known-field/m-p/248544#M74210 jtuni 2016-07-07T19:01:42Z