No worries. It's just that some assumptions which are obvious to the one writing the question might not be clear at all to the readers. Again - there are some ways of approaching this problem, but we need to know what you want to do 🙂 Splunk can carry over the value from the previous result row but as for the additional logic - it has to know what to do with it. Compare this: | makeresults count=10 | streamstats count | eval field{count}=count | table field* With this: | makeresults count=10 | streamstats count | eval field{count}=count | table field* | streamstats current=f last(*) as * The values are carried over. But if there is additional logic which should be applied to them - that's another story. ... View more