Is it possible to assign a value to a different fields. I am trying to combine two different events but the same index. The other one has the field which I needed ip address while the other one doesn't have it in the raw logs. Is it possible to assign/pass the value to the other?   date name description ip 1/15/2023 12:05 xxx this is test 1 192.x.x.x 1/15/2023 12:06 xxx this is test 2   1/15/2023 12:06 xxx this is test 1 192.x.x.x   I tried using eval and passing the data but it fails. Using fill null values and assigning the a fix value doesn't fix it. it should be based from the IP above or within that same date Thanks you in advance for any advice ... View more

Hi guys, Can you please help me , I am trying to create a query in which it shows if a user is in  a different location in the sameday it will only prioritize one of it. please see below | convert timeformat="%F %H:%M" ctime(zone) as ctime | stats count by user fullname country ctime location | rename fullname as "Name", ctime as DateStamp, location as "Location", user as "NetworkID", country as "Country" | fields - count | sort 0 NetworkID This is what i am getting if I'm using the query above NetworkID Name Country DateStamp Location userA A Sample Spain 12-26-2022 Office userA A Sample Spain 12-27-2022 Office userA A Sample Spain 12-27-2022 Home   and this is what I am trying to get that If it's in the same day it will only Select the office NetworkID Name Country DateStamp Location userA A Sample Spain 12-26-2022 Office userA A Sample Spain 12-27-2022 Office Thank you in advance ... View more