Splunk Search

How to fill empty fields with data from a specific event field?

jyab6z
Path Finder
Date...............Time.....................UserID.........................Function.....Main...Sub...Serie...Type

20190312    15:42:16:497    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 1]    ....    ....    6   T
20190312    15:44:51:391    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:00:656    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:19:740    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:27:327    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:44:393    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:55:946    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:57:353    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:59:196    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:46:00:853    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:46:02:806    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:46:31:491    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 1]    ....    ....    All All
20190312    15:47:12:850    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:47:17:915    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:47:21:400    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:47:22:788    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:47:26:069    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:47:28:866    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:47:32:256    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26

I want to fill empty fields "Serie" and "Type" with previous "Serie" and Type" from [Function 1], so the results should be something like this:

20190312    15:42:16:497    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 1]    ....    ....    6   T
20190312    15:44:51:391    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:00:656    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:19:740    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:27:327    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:44:393    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:55:946    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:57:353    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:59:196    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:46:00:853    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:46:02:806    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:46:31:491    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 1]     ....   ....    All All
20190312    15:47:12:850    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      
20190312    15:47:17:915    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      
20190312    15:47:21:400    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      
20190312    15:47:22:788    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      
20190312    15:47:26:069    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      
20190312    15:47:28:866    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      
20190312    15:47:32:256    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      

Or add a new field with eval:

20190312    15:42:16:497    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 1]    ....    ....    6   T     ....   ....
20190312    15:44:51:391    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T 
20190312    15:45:00:656    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:45:19:740    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:45:27:327    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:45:44:393    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:45:55:946    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:45:57:353    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:45:59:196    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:46:00:853    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:46:02:806    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:46:31:491    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 1]    ....    ....    All All    ....   ....
20190312    15:47:12:850    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All 
20190312    15:47:17:915    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All 
20190312    15:47:21:400    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All
20190312    15:47:22:788    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All 
20190312    15:47:26:069    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All
20190312    15:47:28:866    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All
20190312    15:47:32:256    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All

Thanks in advance!

0 Karma
1 Solution

vnravikumar
Champion

Hi

Try this

your query...| sort Time 
| streamstats last(Serie) as Serie, last(Type) as Type 
| table Date,Time,UserID,Function,Main,Sub,Serie,Type

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Try this

your query...| sort Time 
| streamstats last(Serie) as Serie, last(Type) as Type 
| table Date,Time,UserID,Function,Main,Sub,Serie,Type
0 Karma

jyab6z
Path Finder

Thanks! It works!

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...