Alternative to filldown function

[hmahendrakumar]

I have some gaps in my data. I want to fill those gaps only when I visualize it.I have some filler events created via gentimes. I found filldown can be used to get the last known value for a field in these filler events. My problem is filldown is supported only in 4.2 & later. We are using 4.1 now.

Is there an alternative way to achieve the same ?

Eg:-

Before filldown

Time Count

12:00 >1

12:01

12:02

.

.

12:10 > 17

12:11

After filldown

12:00 > 1

12:01 > 1

12:02 > 1

.

.

12:10 > 17

12:11 > 17

[sideview · Accepted solution]

I'm pretty sure streamstats can do this:

| streamstats last(count) as count 

Streamstats has an argument called current, and the default value is t. Which means that as it's operating on each event it will include the current event in the total.

If for some reason you wanted to keep the most recent value separate from the current count, you could do:

| streamstats current=f last(count) as previousCount 

http://www.splunk.com/base/Documentation/latest/SearchReference/Streamstats

[hmahendrakumar]

Thanks nick.. I had an even more older version(splunk 4.0) in my dev env where streamstats wasnt working.. it works in 4.1+

[hmahendrakumar]

let me know if i am not clear enough