Help please! - linkage analysis in Splunk

[tmtcollins]

Hi, I hope someone can help guide me in what type of query or visualisation to use here so show the linkage of access permissions.

I have a simple data set like the format below (I have a much bigger dataset) It shows a user ID and the access they have to a folder.

Users can have access to more than one folder.

I would like to answer the question:

Of the users who have access to a specific folder, say "Apple", what other folders to they have access to and what are the associated volumes with that connection.

I was thinking Sankey diagram but I am having trouble getting the data in the right format.

UserID	Folder
1	Apple
1	Banana
2	Apple
3	Apple
3	Orange

Many thanks, 

Tim

[tmtcollins]

I would like to answer the question:

Of the users who have access to a specific folder, say "Apple", what other folders to they have access to and what are the associated volumes with that connection.

I was thinking Sankey diagram but I am having trouble getting the data in the right format.

UserID	Folder
1	Apple
1	Banana
2	Apple
3	Apple
3	Orange