topic Re: Splunk query issue in Splunk Search

Splunk query issue

santosh11 — Wed, 03 Jun 2020 04:26:17 GMT

Dear All,

I have two columns Id and relationalId below is the sample of it.

Id CorrelationalId
1 2

2 3

3 4

i am looking to get as an output

RelatedCorrelationalId

1 2 3 4

Please can someone guide me on the above issue.

Regards,
Santosh

Re: Splunk query issue

493669 — Wed, 03 Jun 2020 04:28:56 GMT

Can you explain How RelatedCorelationalId field is getting populated?

Re: Splunk query issue

santosh11 — Wed, 03 Jun 2020 04:41:13 GMT

Sorry for the inproper information.

Basically the RelatedCorrelationId is my required Output.

Where i need to get all the interlinked records of Id and corelationalId. Basically parent child relationship. i need to get all that records in one place.

Hope it explains.

Regards,
Santosh

Re: Splunk query issue

493669 — Wed, 03 Jun 2020 04:48:56 GMT

@santosh11 Try below query-

| eval RelatedCorrelationalId = mvappend(Id, CorrelationalId)| stats count by RelatedCorrelationalId | table RelatedCorrelationalId

Below is using sample data-

|makeresults|eval Id="1", CorrelationalId="2"
|append[|makeresults|eval Id="2", CorrelationalId="3"]
|append[|makeresults|eval Id="3", CorrelationalId="4"]
|fields - _time| eval RelatedCorrelationalId = mvappend(Id, CorrelationalId)| stats count by RelatedCorrelationalId | table RelatedCorrelationalId

Let me know if it helps!

Re: Splunk query issue

santosh11 — Wed, 03 Jun 2020 04:57:31 GMT

I am trying that now will update you on the status. Thank you for the response.