How to take output from a lookup and feed it to another lookup and append the results?

[Glasses]

Hi,

Let's say I have a Company directory lookup (e.g. Company_Directory) and I want to lookup the entire hierarchy of supervisors for a specific employee.

For instance>>>

Alice reports to Bob, then take Bob as new lookup criteria...

Bob reports to Cathy, etc....  

and append this all  in a chain of command >>> Alice, Bob, Cathy, Donna, Eric, Fred.... etc

Does Splunk have a command/capability to take the results as feed back to a lookup loop?

Thank you

[PickleRick · Accepted solution]

SPL is not an imperative programming language so apart from some exceptions like foreach it doesn't understand concepts of "loop" and such.

Also, even though you may perform an inputlookup, modify it and outputlookup it at the end, it will only update the contents of the lookup. That lookup won't be processed back again by the same search pipeline. It might get processed by subsequent run (for example if it's a scheduled report).

[Glasses]

Thanks, I didn't really think it was possible to do a loop, but had to ask... 

[PickleRick]

There are tricks to do a bit of imperative-like programming (there was a presentation on it on one of previous .confs) but it's more of a proof-of-concept that it's possible - it's not very practical, not very readable and not very efficient. And of course scope of usability is very very limited.

So it's safe to assume that you can't do such things in general.