Splunk Search

How to dynamically fill null values with the last known field value based on the results of search?

jtuni
Engager

I have log data that doesn't always contain a user ID, but I would like to fill the user ID field with the last known user ID. I am using the streamstats command successfully to do this, but only AFTER there is a user ID to associate to the data. What I would like to do is to take that association and apply it to events that were reviewed prior to that association.

event logs look something like this

ip=1.1.1.1 url=answers.splunk.com
ip=1.1.1.1 url=answers.splunk.com
ip=1.1.1.1 userid=user1 url=answers.splunk.com
ip=1.1.1.1 url=answers.splunk.com
ip=2.2.2.2 url=answers.splunk.com
ip=2.2.2.2 userid=user2 url=answers.splunk.com
ip=2.2.2.2 url=answers.splunk.com

My search is this:

search url=answers.splunk.com | streamstats current=f window=0 global=f last(userid) as last_userid by ip | stats count by last_userid, ip, url

and my results would be

last_userid    ip          url                    count
user1          1.1.1.1     answers.splunk.com     2
user2          2.2.2.2     answers.splunk.com     2

and the results that were prior to the first event log with a userid in it don't get calculated into the result. I need to associated the userid to those events as well.

Tags (4)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

With this works for you

search url=answers.splunk.com | eventstats values(userid) as last_userid by ip | stats count by last_userid, ip, url

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

With this works for you

search url=answers.splunk.com | eventstats values(userid) as last_userid by ip | stats count by last_userid, ip, url

jtuni
Engager

That worked.

0 Karma

sundareshr
Legend

Try filldown command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Filldown

... | filldown user_id | ...

If that doesn't work, try eventstats

jtuni
Engager

I did not try the filldown command. I'm not sure if that will work, but I will try using it to see what sort of results I do get from it. However using eventstats instead of streamstats resolved my issue, thanks.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...