How to assign a field value to other events using streamstats

[Traer001]

Hello,

I am trying to assign a value from one field to all earlier instances of a field until a non-null value is met. So for example, my events may appear like this (for a particular item id):

2021-05-11 09:18:13 ItemId:R231-1993 Moved to Location:M45-1
2021-05-11 09:16:48 ItemId:R231-1993 Retrieved from Location:T97-1
2021-05-11 09:16:17 ItemId:R231-1993 is active
2021-05-11 09:15:02 ItemId:R231-1993 is active
2021-05-11 09:14:13 ItemId:R231-1993 is active
2021-05-11 07:56:12 ItemId:R231-1993 Moved to Location:T97-1
2021-05-11 07:54:23 ItemId:R231-1993 is active
2021-05-11 07:53:41 ItemId:R231-1993 Retrieved from Location:D14-2
2021-05-11 07:52:13 ItemId:R231-1993 is active
2021-05-11 07:51:39 ItemId:R231-1993 is active

Using rex I am able to extract the Location from the events with "Retrieved" to signify the initial starting point. I want to be able to assign the value of that Location to all other events before it until another "Retrieved" event is met. (Essentially, what I'm trying to do is figure out where the initial location is for an item when it first become 'active')

In the case above, I would want all of the events from 07:51:39 to 07:53:41 to have a Location of "D14-2" and for all event from 07:54:23 to 09:16:48 to have a Location of "T97-1".

Is there a way to do this?

[ITWhisperer]

| makeresults
| eval _raw="2021-05-11 09:18:13 ItemId:R231-1993 Moved to Location:M45-1
2021-05-11 09:16:48 ItemId:R231-1993 Retrieved from Location:T97-1
2021-05-11 09:16:17 ItemId:R231-1993 is active
2021-05-11 09:15:02 ItemId:R231-1993 is active
2021-05-11 09:14:13 ItemId:R231-1993 is active
2021-05-11 07:56:12 ItemId:R231-1993 Moved to Location:T97-1
2021-05-11 07:54:23 ItemId:R231-1993 is active
2021-05-11 07:53:41 ItemId:R231-1993 Retrieved from Location:D14-2
2021-05-11 07:52:13 ItemId:R231-1993 is active
2021-05-11 07:51:39 ItemId:R231-1993 is active"
| multikv noheader=t
| fields _raw
| rex "Retrieved from Location:(?<location>.+)"
| filldown

[kamlesh_vaghela · Accepted solution]

@Traer001 

Is this what you looking for?

YOUR_SEARCH
| rex field=_raw "Location:(?<Location>.*)" | filldown Location

Sample:

| makeresults 
| eval d="2021-05-11 09:18:13 ItemId:R231-1993 Moved to Location:M45-1|2021-05-11 09:16:48 ItemId:R231-1993 Retrieved from Location:T97-1|2021-05-11 09:16:17 ItemId:R231-1993 is active|2021-05-11 09:15:02 ItemId:R231-1993 is active|2021-05-11 09:14:13 ItemId:R231-1993 is active|2021-05-11 07:56:12 ItemId:R231-1993 Moved to Location:T97-1|2021-05-11 07:54:23 ItemId:R231-1993 is active|2021-05-11 07:53:41 ItemId:R231-1993 Retrieved from Location:D14-2|2021-05-11 07:52:13 ItemId:R231-1993 is active|2021-05-11 07:51:39 ItemId:R231-1993 is active", d=split(d,"|") 
| mvexpand d 
| rex field=d "^(?<Time>.{19})"
| eval _raw=d, _time=strptime(Time,"%Y-%m-%d %H:%M:%S") | fields - Time d
| rename comment as "Upto Now is sample data only" 
| rex field=_raw "Location:(?<Location>.*)" | filldown Location

Thanks
Kamlesh Vaghela

If this reply helps you, an upvote would be appreciated.