I have log data that doesn't always contain a user ID, but I would like to fill the user ID field with the last known user ID. I am using the streamstats command successfully to do this, but only AFTER there is a user ID to associate to the data. What I would like to do is to take that association and apply it to events that were reviewed prior to that association. event logs look something like this ip=1.1.1.1 url=answers.splunk.com ip=1.1.1.1 url=answers.splunk.com ip=1.1.1.1 userid=user1 url=answers.splunk.com ip=1.1.1.1 url=answers.splunk.com ip=2.2.2.2 url=answers.splunk.com ip=2.2.2.2 userid=user2 url=answers.splunk.com ip=2.2.2.2 url=answers.splunk.com My search is this: search url=answers.splunk.com | streamstats current=f window=0 global=f last(userid) as last_userid by ip | stats count by last_userid, ip, url and my results would be last_userid ip url count user1 1.1.1.1 answers.splunk.com 2 user2 2.2.2.2 answers.splunk.com 2 and the results that were prior to the first event log with a userid in it don't get calculated into the result. I need to associated the userid to those events as well. ... View more