Use streamstats. Here's an example - use the last 3 lines with your data | makeresults format=csv data="ID,message,state
101,executed,started
101,null,in progress
101,none,completed
102,activity pri...
See more...
Use streamstats. Here's an example - use the last 3 lines with your data | makeresults format=csv data="ID,message,state
101,executed,started
101,null,in progress
101,none,completed
102,activity printed,started
102,null,in progress
102,activity printed,completed"
| eval needs_fill=if(message="executed" AND state="started", 1, 0)
| streamstats max(needs_fill) as needs_fill by ID
| eval message=if(needs_fill=1 AND state="completed", "executed", message)