field fillnull with values from correlated events

[fedyshynyuriy]

[somesoni2 · Accepted solution]

Without much information, I'm assuming you want to populate field JsessionST with JsessionST value of different row with same TicketST field value, and each JsessionST value is associated with only one TicketST field value. Please provide more details if these assumptions are wrong. If not, give this a try

index=_* OR index=* sourcetype=nginx | table _time Method TicketST JsessionST | eventstats values(JsessionST) as JsessionST by TicketST

Also, IMO, you don't need to include index=_* in your search as there should be no data in internal indexes for sourcetype nginx. Check that.

[fedyshynyuriy]

Thanks a lot! This is exactly what was required.

[richgalloway]

What is your question? We need more than just a screen shot to know what your problem is.