Splunk Enterprise

Fill null values with field values from previous line/event (conditional fillnull values)

jt_yshi
Engager

Hello Splunk community,

 

I am having some troubles filling my null values with conditional field values.

 

I have events that go through steps  (1-7) and each step is one line eg. one event. However, if there is an Error line there is no step number. In that case I would like to fill the N/A value by the same step value as the previous line/event.

 

Here an example:               

customer_number status step  
1234OK5 
1234OK4 
1234KON/AHere it should be step number 3 
1234Ok3 
1234Ok2 
1234OK1 

 

I would like to fill the N/A value with the step number of the previous line so step 3. 

I tried it with eventstats and streamstats by getting the last step for OK but the KO line is not necessarily the last line for the customer. I also tried it with filldown but it always takes the line above the KO and not the one pior. 

Here is my latest search query that I tried.
| eventstats latest(step) as laststep by customer_number
| eventstats latest(status) as laststatus by customer_number
| eval step=if(status="KO" AND laststatus="KO" AND step="",  laststep,  step)
|filldown step, Step
 

This works when the KO is in the last step. The filldown command would be usefull if it was able to use conditions with it. The ideal solution would a reverse filldown command that would fill the N/A with the values of the events and their fields prior to the KO.

 

Please help! 

thank you in advance! 

Labels (1)
Tags (2)
0 Karma

rnowitzki
Builder

Hi @jt_yshi ,

Can you maybe do it like this?

| sort step
| filldown step
| sort - step

 
BR
Ralph

--
Karma and/or Solution tagging appreciated.

jt_yshi
Engager

Hello @rnowitzki 

 

It works very well! I was looking at way  more complex case and eval function yet the answer seems so simple. 

Thanks for your help, much appreciated!

 

Best regards,

Julia 

Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...