topic Re: Multiple Join/outer within same search in Splunk Search

Multiple Join/outer within same search

eddy_liao — Fri, 25 Oct 2019 19:12:23 GMT

I have a very wierd requirement to transform the result of my search

**EMPLOYEE, BOSS**
ERIC, CHRIS
CHRIS, MACK
MACK, VAL
VAL, WILL

Into this:

**EMPLOYEE, BOSS, BOSS2, BOSS3, BOSS4**
ERIC, CHRIS, MACK, VAL, WILL
CHRIS, MACK, VAL, WILL
MACK, VAL, WILL
VAL, WILL
WIll

I know its a bit wierd and its normal to have missing.
Any ideas?

Re: Multiple Join/outer within same search

woodcock — Fri, 25 Oct 2019 19:43:55 GMT

Like this:

| makeresults 
| eval raw="EMPLOYEE=ERIC,BOSS=CHRIS EMPLOYEE=CHRIS,BOSS=MACK EMPLOYEE=MACK,BOSS=VAL EMPLOYEE=VAL,BOSS=WILL"
| makemv raw
| mvexpand raw
| rename raw AS _raw
| kv
| table EMPLOYEE BOSS

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| outputlookup employee_boss.csv
| lookup employee_boss.csv EMPLOYEE AS BOSS OUTPUT BOSS AS BOSS2
| lookup employee_boss.csv EMPLOYEE AS BOSS2 OUTPUT BOSS AS BOSS3
| lookup employee_boss.csv EMPLOYEE AS BOSS3 OUTPUT BOSS AS BOSS4

Re: Multiple Join/outer within same search

eddy_liao — Fri, 25 Oct 2019 19:49:47 GMT

Thanks this works beautifully

Re: Multiple Join/outer within same search

woodcock — Fri, 25 Oct 2019 22:29:17 GMT

Be sure to come back and click Accept to close the question.