How do I create a field consisting of the previous value for each row of another field?

[alcchang]

I currently have a list of HTTP events that I have formatted like so:

Observe that at the bottom of the image, I have a page with a "NULL" referrer, yet it is the 3rd event in the session (see the "count" field.)

What I want to do is drop in the "request" value of the previous row into all "NULL" values IFF the "count" value of the NULL referrer row is GREATER than 1.

I created a key for this purpose; I tried to use a "join" command but I wish to do this for a large amount of data, and as you may know, the "join" doesn't like to work with large amounts of data. I can see how I could do this with multiple lookups and multiple joins, but this would be unsatisfactory for the long run.

Let me know how I can accomplish this goal. Thanks

[somesoni2 · Accepted solution]

Try adding this to end of your current search

| streamstats current=f window=1 values(request) as prev_req by client_ip
| eval referrer=if(count>1 AND referrer="NULL",prev_req,referrer) 
| fields - prev_req

[alcchang]

This looks good so far, lemme do some checking. Thanks a bunch. That was fast!

[thambisetty]

| makeresults | eval test="1,2,3,4,5" 
| makemv delim="," test
| mvexpand test
| streamstats window=1 last(test) as newfield current=f