Splunk Search

Can I use data from other rows and set them to a different row who have the same key?

yoshilog
Explorer

Hi everyone, 

I would like to ask if it's possible to use data from another row, to be set as the value of a different row with the same key... Such as in the table below. 

idusernamestatus
XC2345 completed
XC2345 in progress
XC2345killjoystarted
ZC9999 in progress
ZC9999jettstarted

 

In the example above, I would like to set the values for usernames of each row with the same id to the same as the one with values, for them to become like this: 

idusernamestatus
XC2345killjoycompleted
XC2345killjoyin progress
XC2345killjoystarted
ZC9999jettin progress
ZC9999jettstarted

 

Would above be possible through eval or another function? 

Labels (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @yoshilog,
Yes, you can use event stats with the last function.

your_Search | eventstats last(username) as username by id

 

If this reply helps you, an upvote/like would be appreciated.

View solution in original post

manjunathmeti
Champion

hi @yoshilog,
Yes, you can use event stats with the last function.

your_Search | eventstats last(username) as username by id

 

If this reply helps you, an upvote/like would be appreciated.

yoshilog
Explorer

Thank you. It worked.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...