Hi all,
I'd like to keep value on a field until the value of this field changes. Please see the following example:
Explanation: I have:
I would like to do
Would anyone have any idea?
Thanks a lot for your help,
Regards,
Ludovic
Try this
your base search with _time field1, field2, field3 | eventstats first(field3) as field3 by field1
Hello somesoni2,
Thank you for your help but it is more complicated because that can be happen that another field3 appear with the same field1 value, for example :
And with your search, I have this :
And I would like to have this :
Any idea ?
Thanks for your help,
Regards,
Running into the same issue. Did you find any proper solution?
Appreciate any help as this would make my life 1,000 times easier.
Thanks,
Tyler
If possible, I'd recommend updating the original code or system to just record that info. That said, it's not always possible, so you could go with something like:
base searchy... | streamstats current=f last(field3) AS newfield | eval field3=if(isnull(field3),newfield,field3) | table _time field1 field2 field3
The streamstats command will carry forward the value; the eval basically checks to see if it already existed, and if so, retain the new value. Bit of a roundabout way to do it, there might be a better way.