Splunk Search

How to dynamically fill null values with the last known field value based on the results of search?

jtuni
Engager

I have log data that doesn't always contain a user ID, but I would like to fill the user ID field with the last known user ID. I am using the streamstats command successfully to do this, but only AFTER there is a user ID to associate to the data. What I would like to do is to take that association and apply it to events that were reviewed prior to that association.

event logs look something like this

ip=1.1.1.1 url=answers.splunk.com
ip=1.1.1.1 url=answers.splunk.com
ip=1.1.1.1 userid=user1 url=answers.splunk.com
ip=1.1.1.1 url=answers.splunk.com
ip=2.2.2.2 url=answers.splunk.com
ip=2.2.2.2 userid=user2 url=answers.splunk.com
ip=2.2.2.2 url=answers.splunk.com

My search is this:

search url=answers.splunk.com | streamstats current=f window=0 global=f last(userid) as last_userid by ip | stats count by last_userid, ip, url

and my results would be

last_userid    ip          url                    count
user1          1.1.1.1     answers.splunk.com     2
user2          2.2.2.2     answers.splunk.com     2

and the results that were prior to the first event log with a userid in it don't get calculated into the result. I need to associated the userid to those events as well.

Tags (4)
0 Karma
1 Solution

somesoni2
Revered Legend

With this works for you

search url=answers.splunk.com | eventstats values(userid) as last_userid by ip | stats count by last_userid, ip, url

View solution in original post

somesoni2
Revered Legend

With this works for you

search url=answers.splunk.com | eventstats values(userid) as last_userid by ip | stats count by last_userid, ip, url

jtuni
Engager

That worked.

0 Karma

sundareshr
Legend

Try filldown command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Filldown

... | filldown user_id | ...

If that doesn't work, try eventstats

jtuni
Engager

I did not try the filldown command. I'm not sure if that will work, but I will try using it to see what sort of results I do get from it. However using eventstats instead of streamstats resolved my issue, thanks.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...