Splunk Search

How to dynamically fill null values with the last known field value based on the results of search?

jtuni
Engager

I have log data that doesn't always contain a user ID, but I would like to fill the user ID field with the last known user ID. I am using the streamstats command successfully to do this, but only AFTER there is a user ID to associate to the data. What I would like to do is to take that association and apply it to events that were reviewed prior to that association.

event logs look something like this

ip=1.1.1.1 url=answers.splunk.com
ip=1.1.1.1 url=answers.splunk.com
ip=1.1.1.1 userid=user1 url=answers.splunk.com
ip=1.1.1.1 url=answers.splunk.com
ip=2.2.2.2 url=answers.splunk.com
ip=2.2.2.2 userid=user2 url=answers.splunk.com
ip=2.2.2.2 url=answers.splunk.com

My search is this:

search url=answers.splunk.com | streamstats current=f window=0 global=f last(userid) as last_userid by ip | stats count by last_userid, ip, url

and my results would be

last_userid    ip          url                    count
user1          1.1.1.1     answers.splunk.com     2
user2          2.2.2.2     answers.splunk.com     2

and the results that were prior to the first event log with a userid in it don't get calculated into the result. I need to associated the userid to those events as well.

Tags (4)
0 Karma
1 Solution

somesoni2
Revered Legend

With this works for you

search url=answers.splunk.com | eventstats values(userid) as last_userid by ip | stats count by last_userid, ip, url

View solution in original post

somesoni2
Revered Legend

With this works for you

search url=answers.splunk.com | eventstats values(userid) as last_userid by ip | stats count by last_userid, ip, url

jtuni
Engager

That worked.

0 Karma

sundareshr
Legend

Try filldown command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Filldown

... | filldown user_id | ...

If that doesn't work, try eventstats

jtuni
Engager

I did not try the filldown command. I'm not sure if that will work, but I will try using it to see what sort of results I do get from it. However using eventstats instead of streamstats resolved my issue, thanks.

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...