Splunk Search

How do we chain up events based on parent-child events without recursion?

tchen_splunk
Splunk Employee
Splunk Employee

Let's say I have something like this:

time,ParentId,ChildId
12:05:10 PM, ,A1
12:05:11 PM, ,B1
12:05:12 PM,A1 ,A2
12:05:13 PM, ,C1
12:05:14 PM,B1 ,B2
12:05:15 PM,B2 ,B3
12:05:16 PM,A2 ,A3
12:05:17 PM,B3 ,B4
12:05:18 PM,C1 ,C2

As we can see above, we have this parent-child chain going from B1<--B2<--B3<--B4

is there a way to chain up these events without recursion?

Tags (1)
0 Karma
1 Solution

tchen_splunk
Splunk Employee
Splunk Employee

Turned out there is indeed a way to do this within Splunk, with the Transaction command:

  | eval ParentId=coalesce(ParentId,ChildId) | eval pc=ParentId.":".ChildId  | makemv delim=":" pc | transaction pc

Thanks to d for providing the solution!

View solution in original post

0 Karma

tchen_splunk
Splunk Employee
Splunk Employee

Turned out there is indeed a way to do this within Splunk, with the Transaction command:

  | eval ParentId=coalesce(ParentId,ChildId) | eval pc=ParentId.":".ChildId  | makemv delim=":" pc | transaction pc

Thanks to d for providing the solution!

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...