Hi @gcusello, I'm sorry. In the real case, the timestamp is not equal. So I cannot use BY _time... Any other ideas?   What I'm trying to figure out is how to use xxx123 as a temporary value, and then whenever there is another document1 that occurs in new events, I can assign the value to the new events.   Thank you.😁 ... View more

Hi @gcusello, Thanks for your reply. I'm in the first case you mentioned. But I do not know how to use appendpipe to achieve the goal. Let's look at an example.  | makeresults | eval raw="xxx123,document1,orderRequest;document1,orderRequest" | makemv delim=";" raw | mvexpand raw | rex field=raw "(?<id>\w+),doc" Currently, the id field in the second event is empty, and I'd like to fill it with xxx123, since it is also the document1 type.  Could you write a query to achieve this one? Thanks again! ... View more

Hi renjith_nair, Thanks for your reply. I understand that this command will interchange the position of month and date. But it seems the first time I see something like "\2/\1/". Could you please tell me when we could use something like that?   ... View more