First of all, many thanks for your support and sorry if I'm wasting time. Theoretically, there should only be a maximum of 3 versions. In practice, however, I have seen more versions at the same time. I had originally hoped that splunk had native support for the LOCF topic, which I have not yet found out. In my research so far I have not come across this and have only discovered complex cross-join solutions. Perhaps it is the wrong use case for this requirement and I need to proceed differently: daily recording of the version for all items Disadvantage: over 100,000 log entries are recorded daily cron job that records the missing versions for all items Disadvantage: here too, over 100,000 log entries are recorded daily usage of a different tool for this use case, e.g. influxDB. Native LOCF support seems to exist here. Disadvantage: several tools must be supported ... View more

There could be maximum 3 versions per day. ... View more

Hi @richgalloway, yes I already tried the filldown command. But I had no sucess with it. Probably I made it wrong. In the current thread I replied my use case to @PickleRick. ... View more

Hi @PickleRick , the use case is like the following description... My input is like the following json: { "timestamp": "2025-06-01T09:26:00.000Z", "item":"I.1","version":"1.1.0-1"} { "timestamp": "2025-06-01T09:26:00.000Z", "item":"I.2","version":"1.1.0-1"} { "timestamp": "2025-06-01T09:26:00.000Z", "item":"I.3","version":"1.1.0-1"} { "timestamp": "2025-06-01T09:26:00.000Z", "item":"I.4","version":"1.1.0-1"} { "timestamp": "2025-08-01T09:26:00.000Z", "item":"I.1","version":"1.1.0-2"} There are 4 items at 06/01 and one item with an advanced version at 08/01.   The query just counts the current version per day. source="..." | eval day=strftime(_time, "%Y-%m-%d") | chart count by day, version   The actual result is: | day                   | 1.1.0-1 | 1.1.0-2 | | -----------------| --------- |----------| | 2025-06-01 |  4            |  0           | | 2025-08-01 |  0            |  1           |   but what I expect is: | day                   | 1.1.0-1 | 1.1.0-2 | | ---------------- | --------- | ---------- | | 2025-06-01 |  4           |  0             | | 2025-07-01 |  4           |  0             | | 2025-08-01 |  3           |  1             |   Another challenge is that I want to spread the result for about 60 days and there are over 100.000 items. ... View more