Date...............Time.....................UserID.........................Function.....Main...Sub...Serie...Type
20190312 15:42:16:497 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... 6 T
20190312 15:44:51:391 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:45:00:656 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:45:19:740 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:45:27:327 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:45:44:393 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:45:55:946 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:45:57:353 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:45:59:196 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:46:00:853 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:46:02:806 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:46:31:491 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... All All
20190312 15:47:12:850 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:47:17:915 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:47:21:400 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:47:22:788 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:47:26:069 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:47:28:866 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
20190312 15:47:32:256 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26
I want to fill empty fields "Serie" and "Type" with previous "Serie" and Type" from [Function 1], so the results should be something like this:
20190312 15:42:16:497 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... 6 T
20190312 15:44:51:391 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T
20190312 15:45:00:656 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T
20190312 15:45:19:740 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T
20190312 15:45:27:327 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T
20190312 15:45:44:393 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T
20190312 15:45:55:946 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T
20190312 15:45:57:353 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T
20190312 15:45:59:196 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T
20190312 15:46:00:853 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T
20190312 15:46:02:806 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 6 T
20190312 15:46:31:491 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... All All
20190312 15:47:12:850 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All
20190312 15:47:17:915 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All
20190312 15:47:21:400 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All
20190312 15:47:22:788 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All
20190312 15:47:26:069 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All
20190312 15:47:28:866 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All
20190312 15:47:32:256 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 All All
Or add a new field with eval:
20190312 15:42:16:497 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... 6 T .... ....
20190312 15:44:51:391 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T
20190312 15:45:00:656 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T
20190312 15:45:19:740 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T
20190312 15:45:27:327 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T
20190312 15:45:44:393 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T
20190312 15:45:55:946 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T
20190312 15:45:57:353 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T
20190312 15:45:59:196 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T
20190312 15:46:00:853 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T
20190312 15:46:02:806 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... 6 T
20190312 15:46:31:491 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 1] .... .... All All .... ....
20190312 15:47:12:850 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All
20190312 15:47:17:915 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All
20190312 15:47:21:400 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All
20190312 15:47:22:788 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All
20190312 15:47:26:069 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All
20190312 15:47:28:866 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All
20190312 15:47:32:256 [f5lnqq3xbdhnla0yq4ndm3jc] [Function 2] 03 26 .... .... All All
Thanks in advance!
Hi
Try this
your query...| sort Time
| streamstats last(Serie) as Serie, last(Type) as Type
| table Date,Time,UserID,Function,Main,Sub,Serie,Type
Hi
Try this
your query...| sort Time
| streamstats last(Serie) as Serie, last(Type) as Type
| table Date,Time,UserID,Function,Main,Sub,Serie,Type
Thanks! It works!