Splunk query - update a field with first value of the field

[ma_anand1984]

I'm trying to write a query that converts table 1 to table 2
Basically, i want to retain first value of flower for city-place combination for all rows

Any easiest way to do this?

table1
city   place  flower
NC     A        rose
NC     B        lily
NC     C        sunflower
DE     A        scarlet
DE     B        rose
DE     C        lily     

Table2
city   place  flower
NC     A        rose
NC     B        rose
NC     C        rose
DE     A        scarlet
DE     B        scarlet
DE     C        scarlet

[Ayn · Accepted solution]

You could probably use eventstats for this:

... | eventstats first(flower) as flower by city