topic How to combine rows based on parent-child relationship on separate fields in Splunk Search

How to combine rows based on parent-child relationship on separate fields

yolk — Fri, 08 Dec 2023 08:00:49 GMT

Hi,

I have data like these entries

link id parent name
---- --- -------- ---------

link1 311 email.eml

link1 312 311 abc.rar

link2 315 312 xyz.exe

that I want to combine into this

link id parent name
---- --- -------- ---------

link1, link2 315, 312, 311 312, 311 xyz.exe, abc.rar, email.eml

Combining condition is based on id and parent.

311 is the parent, 312 is child of 311, 315 is child of 312 ('grandchild' of 311)

Thank you in advance for your help!

Re: How to combine rows based on parent-child relationship on separate fields

oda — Fri, 22 Dec 2023 07:42:21 GMT

I would like to create an answer, but could you please tell me the final form you would like to create?

Re: How to combine rows based on parent-child relationship on separate fields

yolk — Wed, 27 Dec 2023 01:24:12 GMT

Hi,

Thanks for helping! This is the final output I would like to create as stated in original post.

link id parent name
---- --- -------- ---------
link1, link2 315, 312, 311 312, 311 xyz.exe, abc.rar, email.eml

Re: How to combine rows based on parent-child relationship on separate fields

oda — Wed, 27 Dec 2023 02:20:28 GMT

Oops
I understand your explanation.

That's difficult to achieve with Splunk.
Please refer to the URL below for details.

https://community.splunk.com/t5/Splunk-Search/recursively-join-the-same-table/m-p/140079

If you have other conditions, you may be able to do it.
Example
- This log is an experiment log and can be identified for each experiment.
- Logs that are always parent and child will be displayed below.