I have log data that doesn't always contain a user ID, but I would like to fill the user ID field with the last known user ID. I am using the streamstats command successfully to do this, but only AFTER there is a user ID to associate to the data. What I would like to do is to take that association and apply it to events that were reviewed prior to that association.
event logs look something like this
ip=1.1.1.1 url=answers.splunk.com
ip=1.1.1.1 url=answers.splunk.com
ip=1.1.1.1 userid=user1 url=answers.splunk.com
ip=1.1.1.1 url=answers.splunk.com
ip=2.2.2.2 url=answers.splunk.com
ip=2.2.2.2 userid=user2 url=answers.splunk.com
ip=2.2.2.2 url=answers.splunk.com
My search is this:
search url=answers.splunk.com | streamstats current=f window=0 global=f last(userid) as last_userid by ip | stats count by last_userid, ip, url
and my results would be
last_userid ip url count
user1 1.1.1.1 answers.splunk.com 2
user2 2.2.2.2 answers.splunk.com 2
and the results that were prior to the first event log with a userid in it don't get calculated into the result. I need to associated the userid to those events as well.
With this works for you
search url=answers.splunk.com | eventstats values(userid) as last_userid by ip | stats count by last_userid, ip, url
With this works for you
search url=answers.splunk.com | eventstats values(userid) as last_userid by ip | stats count by last_userid, ip, url
That worked.
Try filldown
command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Filldown
... | filldown user_id | ...
If that doesn't work, try eventstats
I did not try the filldown command. I'm not sure if that will work, but I will try using it to see what sort of results I do get from it. However using eventstats instead of streamstats resolved my issue, thanks.