Build a parent child relation

[bharathkumarnec]

Hi All,

Below is my situation:

parentkey childkey

b c
0 a
a b
b d
b e

Output is to be like this 0-->a-->b-->c,d,e

How can i achieve this in splunk??

TIA

Regards,
BK

[Sukisen1981 · Accepted solution]

|stats values(childkey) by parentkey |rename values(childkey) as chld | mvexpand chld

[bharathkumarnec]

this is valid only when we have a parent and children, but in my case i have grand children as well...

[Sukisen1981]

hi @bharathkumarnec
in that case ,can you please provide a clearer description of the 'grandchildren' and a more exact requirement?
both @mayurr98 and my answers were based on what you posted in the question.

[mayurr98]

try this ?

| stats values(childkey) as childkey by parentkey