Splunk Search

Alternative to filldown function

hmahendrakumar
Path Finder

I have some gaps in my data. I want to fill those gaps only when I visualize it.I have some filler events created via gentimes. I found filldown can be used to get the last known value for a field in these filler events. My problem is filldown is supported only in 4.2 & later. We are using 4.1 now.

Is there an alternative way to achieve the same ?

Eg:-

Before filldown

Time Count

12:00 >1

12:01

12:02

.

.

12:10 > 17

12:11

After filldown

12:00 > 1

12:01 > 1

12:02 > 1

.

.

12:10 > 17

12:11 > 17

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

I'm pretty sure streamstats can do this:

| streamstats last(count) as count 

Streamstats has an argument called current, and the default value is t. Which means that as it's operating on each event it will include the current event in the total.

If for some reason you wanted to keep the most recent value separate from the current count, you could do:

| streamstats current=f last(count) as previousCount 

http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats

View solution in original post

sideview
SplunkTrust
SplunkTrust

I'm pretty sure streamstats can do this:

| streamstats last(count) as count 

Streamstats has an argument called current, and the default value is t. Which means that as it's operating on each event it will include the current event in the total.

If for some reason you wanted to keep the most recent value separate from the current count, you could do:

| streamstats current=f last(count) as previousCount 

http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats

hmahendrakumar
Path Finder

Thanks nick.. I had an even more older version(splunk 4.0) in my dev env where streamstats wasnt working.. it works in 4.1+

0 Karma

hmahendrakumar
Path Finder

let me know if i am not clear enough

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...