my tablular output contains columns/fields like,
account_number | colour | team_name | business_unit
I am getting the above output by stats aggregating BY 'account_number'.
Some of the events with the same account_number has null (colour, team_name and business_unit) values. So I used ,
| streamstats last(colour) as colour,
last(team_name ) as team_name ,
last(team_name ) as team_name .
to populate from the previous row values.
I want streamstats to populate the empty fields with the previous row value, "ONLY IF, the previous row "account_number" is same with the current row".
The issue I am getting now is, lets say. I have three rows with account_number value 0001. and if 4th row has account_number is 0002 and has other three fields (colour, team_name and business_unit) empty, it is populating them with the previous 0001 account_number's value , which is incorrect.
No, I haven't.
Is this the correct way of using it ?
| streamstats last(colour) as colour,
last(team_name ) as team_name ,
last(team_name ) as team_name
reset_on_change=true
Also, do I have to use the BY clause here ?
BY <the field comparing which I want the reset to be applied, 'account_number' field> ???