Splunk Search

Build a parent child relation

bharathkumarnec
Communicator

Hi All,

Below is my situation:

parentkey childkey

b c
0 a
a b
b d
b e

Output is to be like this 0-->a-->b-->c,d,e

How can i achieve this in splunk??

TIA

Regards,
BK

0 Karma
1 Solution

Sukisen1981
Champion

|stats values(childkey) by parentkey |rename values(childkey) as chld | mvexpand chld

View solution in original post

0 Karma

Sukisen1981
Champion

|stats values(childkey) by parentkey |rename values(childkey) as chld | mvexpand chld

View solution in original post

0 Karma

bharathkumarnec
Communicator

this is valid only when we have a parent and children, but in my case i have grand children as well...

0 Karma

Sukisen1981
Champion

hi @bharathkumarnec
in that case ,can you please provide a clearer description of the 'grandchildren' and a more exact requirement?
both @mayurr98 and my answers were based on what you posted in the question.

0 Karma

mayurr98
SplunkTrust
SplunkTrust

try this ?

| stats values(childkey) as childkey by parentkey
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.