https://community.splunk.com/t5/Splunk-Search/Recursive-searches-based-on-parent-ids/m-p/12723#M1061 <P>I believe in Splunk 4.1 you can do:</P> <PRE><CODE>sourcetype=messages | eval f=id." ".parent | makemv f delim=" " | transaction f </CODE></PRE> <P>but that the <CODE>transaction</CODE> command in 4.0 and below won't do this.</P> Sat, 01 May 2010 04:25:42 GMT gkanapathy 2010-05-01T04:25:42Z https://community.splunk.com/t5/Splunk-Search/Recursive-searches-based-on-parent-ids/m-p/12722#M1060 <P>We have logs that do stuff like this:</P> <PRE><CODE> message id=1 message id=2 parent=1 message id=2 parent=1 message id=3 parent=1 message id=5 parent=2 message id=5 parent=2 message id=6 parent=5 message id=6 parent=5 </CODE></PRE> <P>It's easy enough to do a subsearch that gets one level of relationship, but is there any way to search for all related messages recursively?</P> Sat, 01 May 2010 04:14:49 GMT https://community.splunk.com/t5/Splunk-Search/Recursive-searches-based-on-parent-ids/m-p/12722#M1060 vbumgarn 2010-05-01T04:14:49Z https://community.splunk.com/t5/Splunk-Search/Recursive-searches-based-on-parent-ids/m-p/12723#M1061 <P>I believe in Splunk 4.1 you can do:</P> <PRE><CODE>sourcetype=messages | eval f=id." ".parent | makemv f delim=" " | transaction f </CODE></PRE> <P>but that the <CODE>transaction</CODE> command in 4.0 and below won't do this.</P> Sat, 01 May 2010 04:25:42 GMT https://community.splunk.com/t5/Splunk-Search/Recursive-searches-based-on-parent-ids/m-p/12723#M1061 gkanapathy 2010-05-01T04:25:42Z