Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do I use the latest value given to replace a field that is NULL but both event have one common value?

$
0
0
As stated I want the latest value in "Hash Value" and "Type" column to be filled instead of being "NA" and "Unknown" which I hardcoded if NULL. I want the latest value to be carried over instead of being null if the "Location" column have the common value. Referring to the screenshot, I want the file "what is this", its hash value and type from the latest which is below it to be carried up. ![alt text][1] [1]: /storage/temp/216758-point.png

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>