Hello,
I am trying to assign a value from one field to all earlier instances of a field until a non-null value is met. So for example, my events may appear like this (for a particular item id):
2021-05-11 09:18:13 ItemId:R231-1993 Moved to Location:M45-1
2021-05-11 09:16:48 ItemId:R231-1993 Retrieved from Location:T97-1
2021-05-11 09:16:17 ItemId:R231-1993 is active
2021-05-11 09:15:02 ItemId:R231-1993 is active
2021-05-11 09:14:13 ItemId:R231-1993 is active
2021-05-11 07:56:12 ItemId:R231-1993 Moved to Location:T97-1
2021-05-11 07:54:23 ItemId:R231-1993 is active
2021-05-11 07:53:41 ItemId:R231-1993 Retrieved from Location:D14-2
2021-05-11 07:52:13 ItemId:R231-1993 is active
2021-05-11 07:51:39 ItemId:R231-1993 is active
Using rex I am able to extract the Location from the events with "Retrieved" to signify the initial starting point. I want to be able to assign the value of that Location to all other events before it until another "Retrieved" event is met. (Essentially, what I'm trying to do is figure out where the initial location is for an item when it first become 'active')
In the case above, I would want all of the events from 07:51:39 to 07:53:41 to have a Location of "D14-2" and for all event from 07:54:23 to 09:16:48 to have a Location of "T97-1".
Is there a way to do this?
Is this what you looking for?
YOUR_SEARCH
| rex field=_raw "Location:(?<Location>.*)" | filldown Location
Sample:
| makeresults
| eval d="2021-05-11 09:18:13 ItemId:R231-1993 Moved to Location:M45-1|2021-05-11 09:16:48 ItemId:R231-1993 Retrieved from Location:T97-1|2021-05-11 09:16:17 ItemId:R231-1993 is active|2021-05-11 09:15:02 ItemId:R231-1993 is active|2021-05-11 09:14:13 ItemId:R231-1993 is active|2021-05-11 07:56:12 ItemId:R231-1993 Moved to Location:T97-1|2021-05-11 07:54:23 ItemId:R231-1993 is active|2021-05-11 07:53:41 ItemId:R231-1993 Retrieved from Location:D14-2|2021-05-11 07:52:13 ItemId:R231-1993 is active|2021-05-11 07:51:39 ItemId:R231-1993 is active", d=split(d,"|")
| mvexpand d
| rex field=d "^(?<Time>.{19})"
| eval _raw=d, _time=strptime(Time,"%Y-%m-%d %H:%M:%S") | fields - Time d
| rename comment as "Upto Now is sample data only"
| rex field=_raw "Location:(?<Location>.*)" | filldown Location
Thanks
Kamlesh Vaghela
If this reply helps you, an upvote would be appreciated.
| makeresults
| eval _raw="2021-05-11 09:18:13 ItemId:R231-1993 Moved to Location:M45-1
2021-05-11 09:16:48 ItemId:R231-1993 Retrieved from Location:T97-1
2021-05-11 09:16:17 ItemId:R231-1993 is active
2021-05-11 09:15:02 ItemId:R231-1993 is active
2021-05-11 09:14:13 ItemId:R231-1993 is active
2021-05-11 07:56:12 ItemId:R231-1993 Moved to Location:T97-1
2021-05-11 07:54:23 ItemId:R231-1993 is active
2021-05-11 07:53:41 ItemId:R231-1993 Retrieved from Location:D14-2
2021-05-11 07:52:13 ItemId:R231-1993 is active
2021-05-11 07:51:39 ItemId:R231-1993 is active"
| multikv noheader=t
| fields _raw
| rex "Retrieved from Location:(?<location>.+)"
| filldown
Is this what you looking for?
YOUR_SEARCH
| rex field=_raw "Location:(?<Location>.*)" | filldown Location
Sample:
| makeresults
| eval d="2021-05-11 09:18:13 ItemId:R231-1993 Moved to Location:M45-1|2021-05-11 09:16:48 ItemId:R231-1993 Retrieved from Location:T97-1|2021-05-11 09:16:17 ItemId:R231-1993 is active|2021-05-11 09:15:02 ItemId:R231-1993 is active|2021-05-11 09:14:13 ItemId:R231-1993 is active|2021-05-11 07:56:12 ItemId:R231-1993 Moved to Location:T97-1|2021-05-11 07:54:23 ItemId:R231-1993 is active|2021-05-11 07:53:41 ItemId:R231-1993 Retrieved from Location:D14-2|2021-05-11 07:52:13 ItemId:R231-1993 is active|2021-05-11 07:51:39 ItemId:R231-1993 is active", d=split(d,"|")
| mvexpand d
| rex field=d "^(?<Time>.{19})"
| eval _raw=d, _time=strptime(Time,"%Y-%m-%d %H:%M:%S") | fields - Time d
| rename comment as "Upto Now is sample data only"
| rex field=_raw "Location:(?<Location>.*)" | filldown Location
Thanks
Kamlesh Vaghela
If this reply helps you, an upvote would be appreciated.