Splunk Search

How do I create a field consisting of the previous value for each row of another field?

alcchang
Engager

I currently have a list of HTTP events that I have formatted like so:

alt text

Observe that at the bottom of the image, I have a page with a "NULL" referrer, yet it is the 3rd event in the session (see the "count" field.)

What I want to do is drop in the "request" value of the previous row into all "NULL" values IFF the "count" value of the NULL referrer row is GREATER than 1.

I created a key for this purpose; I tried to use a "join" command but I wish to do this for a large amount of data, and as you may know, the "join" doesn't like to work with large amounts of data. I can see how I could do this with multiple lookups and multiple joins, but this would be unsatisfactory for the long run.

Let me know how I can accomplish this goal. Thanks

0 Karma
1 Solution

somesoni2
Revered Legend

Try adding this to end of your current search

| streamstats current=f window=1 values(request) as prev_req by client_ip
| eval referrer=if(count>1 AND referrer="NULL",prev_req,referrer) 
| fields - prev_req

View solution in original post

somesoni2
Revered Legend

Try adding this to end of your current search

| streamstats current=f window=1 values(request) as prev_req by client_ip
| eval referrer=if(count>1 AND referrer="NULL",prev_req,referrer) 
| fields - prev_req

View solution in original post

alcchang
Engager

This looks good so far, lemme do some checking. Thanks a bunch. That was fast!

0 Karma

thambisetty
Super Champion
| makeresults | eval test="1,2,3,4,5" 
| makemv delim="," test
| mvexpand test
| streamstats window=1 last(test) as newfield current=f
————————————
If this helps, give a like below.
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.