Splunk Search

how to duplicate value in one row to multiple rows.

theouhuios
Motivator

Hello

I am trying to duplicate the values of status and user for all rows below so that I can use them in my search later. Is there a way to have all rows filled with the status and user automatically ?

alt text

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Use eventstats.

... | eventstats first(status) as status, first(user) as user | ...

View solution in original post

Ayn
Legend

Use eventstats.

... | eventstats first(status) as status, first(user) as user | ...
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...