Hello Splunk community, I am having some troubles filling my null values with conditional field values. I have events that go through steps (1-7) and each step is one line eg. one event. However, if there is an Error line there is no step number. In that case I would like to fill the N/A value by the same step value as the previous line/event. Here an example: customer_number status step 1234 OK 5 1234 OK 4 1234 KO N/A Here it should be step number 3 1234 Ok 3 1234 Ok 2 1234 OK 1 I would like to fill the N/A value with the step number of the previous line so step 3. I tried it with eventstats and streamstats by getting the last step for OK but the KO line is not necessarily the last line for the customer. I also tried it with filldown but it always takes the line above the KO and not the one pior. Here is my latest search query that I tried. | eventstats latest(step) as laststep by customer_number | eventstats latest(status) as laststatus by customer_number | eval step=if(status="KO" AND laststatus="KO" AND step="", laststep, step) |filldown step, Step This works when the KO is in the last step. The filldown command would be usefull if it was able to use conditions with it. The ideal solution would a reverse filldown command that would fill the N/A with the values of the events and their fields prior to the KO. Please help! thank you in advance!
... View more
