Fill empty fields backwards with streamstats

[Kristian_86]

Hi,
I have the following issue:
Have many events with different document_number+datetime_type, which have a field (started_on).
There is always 4 different types / document_number.
Then 4 new timestamp fields are evaluated by the type and the timestamp, so each event will have 1 new filled timestamp in a different field.

Now I need to fill the empty ones from the evaluated ones for the same document_number.
With streamstats I was able to fill them further (after found), but not backwards.

Is it possible somehow?
Or only if I do | reverse and apply streamstats again?

[ITWhisperer]

Why not just use stats (instead of streamstats)?

[Kristian_86]

like? Could you please provide an example?
If I will use stats it will merge the 4 events into 1 or not fill the empty ones / document type
The main key fields are document_number and document_type which are required further.
So with:

• | stats max(timestamp1) as timestamp1, max(timestamp2) as timestamp2, ... by document_number
  will unify the events by document_number which is not what I would like to achieve as there are many other fields required, which are not shown in the example.
• | stats max(timestamp1) as timestamp1, max(timestamp2) as timestamp2, .. by document_number, document_type
  will do nothing as will select the event from itself and leave the empty fields empty.
  

P.S.: sorry I forgot to add the datetime_type to the example pictures, will add them.

[ITWhisperer · Accepted solution]

Try eventstats instead of stats if you want to keep the original events

[Kristian_86]

Working as expected, thank you 🙂