How to fill empty fields with data from a specific event field?

[jyab6z]

Date...............Time.....................UserID.........................Function.....Main...Sub...Serie...Type

20190312    15:42:16:497    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 1]    ....    ....    6   T
20190312    15:44:51:391    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:00:656    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:19:740    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:27:327    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:44:393    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:55:946    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:57:353    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:45:59:196    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:46:00:853    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:46:02:806    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:46:31:491    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 1]    ....    ....    All All
20190312    15:47:12:850    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:47:17:915    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:47:21:400    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:47:22:788    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:47:26:069    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:47:28:866    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26       
20190312    15:47:32:256    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26

I want to fill empty fields "Serie" and "Type" with previous "Serie" and Type" from [Function 1], so the results should be something like this:

20190312    15:42:16:497    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 1]    ....    ....    6   T
20190312    15:44:51:391    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:00:656    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:19:740    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:27:327    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:44:393    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:55:946    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:57:353    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:45:59:196    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:46:00:853    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:46:02:806    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  6   T        
20190312    15:46:31:491    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 1]     ....   ....    All All
20190312    15:47:12:850    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      
20190312    15:47:17:915    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      
20190312    15:47:21:400    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      
20190312    15:47:22:788    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      
20190312    15:47:26:069    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      
20190312    15:47:28:866    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      
20190312    15:47:32:256    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  All All      

Or add a new field with eval:

20190312    15:42:16:497    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 1]    ....    ....    6   T     ....   ....
20190312    15:44:51:391    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T 
20190312    15:45:00:656    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:45:19:740    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:45:27:327    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:45:44:393    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:45:55:946    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:45:57:353    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:45:59:196    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:46:00:853    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:46:02:806    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    6   T
20190312    15:46:31:491    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 1]    ....    ....    All All    ....   ....
20190312    15:47:12:850    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All 
20190312    15:47:17:915    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All 
20190312    15:47:21:400    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All
20190312    15:47:22:788    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All 
20190312    15:47:26:069    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All
20190312    15:47:28:866    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All
20190312    15:47:32:256    [f5lnqq3xbdhnla0yq4ndm3jc]  [Function 2]    03  26  ....    ....    All All

Thanks in advance!

[vnravikumar · Accepted solution]

Hi

Try this

your query...| sort Time 
| streamstats last(Serie) as Serie, last(Type) as Type 
| table Date,Time,UserID,Function,Main,Sub,Serie,Type

[jyab6z]

Thanks! It works!