How to dynamically fill null values with the last known field value based on the results of search?

[jtuni]

I have log data that doesn't always contain a user ID, but I would like to fill the user ID field with the last known user ID. I am using the streamstats command successfully to do this, but only AFTER there is a user ID to associate to the data. What I would like to do is to take that association and apply it to events that were reviewed prior to that association.

event logs look something like this

ip=1.1.1.1 url=answers.splunk.com
ip=1.1.1.1 url=answers.splunk.com
ip=1.1.1.1 userid=user1 url=answers.splunk.com
ip=1.1.1.1 url=answers.splunk.com
ip=2.2.2.2 url=answers.splunk.com
ip=2.2.2.2 userid=user2 url=answers.splunk.com
ip=2.2.2.2 url=answers.splunk.com

My search is this:

search url=answers.splunk.com | streamstats current=f window=0 global=f last(userid) as last_userid by ip | stats count by last_userid, ip, url

and my results would be

last_userid    ip          url                    count
user1          1.1.1.1     answers.splunk.com     2
user2          2.2.2.2     answers.splunk.com     2

and the results that were prior to the first event log with a userid in it don't get calculated into the result. I need to associated the userid to those events as well.

[somesoni2 · Accepted solution]

With this works for you

search url=answers.splunk.com | eventstats values(userid) as last_userid by ip | stats count by last_userid, ip, url

[jtuni]

That worked.

[sundareshr]

Try filldown command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Filldown

... | filldown user_id | ...

If that doesn't work, try eventstats

[jtuni]

I did not try the filldown command. I'm not sure if that will work, but I will try using it to see what sort of results I do get from it. However using eventstats instead of streamstats resolved my issue, thanks.