Splunk Search

Multiple Join/outer within same search

eddy_liao
Engager

Hi

I have a very wierd requirement to transform the result of my search

**EMPLOYEE, BOSS**
ERIC, CHRIS
CHRIS, MACK
MACK, VAL
VAL, WILL

Into this:

**EMPLOYEE, BOSS, BOSS2, BOSS3, BOSS4**
ERIC, CHRIS, MACK, VAL, WILL
CHRIS, MACK, VAL, WILL
MACK, VAL, WILL
VAL, WILL
WIll

I know its a bit wierd and its normal to have missing.
Any ideas?

1 Solution

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval raw="EMPLOYEE=ERIC,BOSS=CHRIS EMPLOYEE=CHRIS,BOSS=MACK EMPLOYEE=MACK,BOSS=VAL EMPLOYEE=VAL,BOSS=WILL"
| makemv raw
| mvexpand raw
| rename raw AS _raw
| kv
| table EMPLOYEE BOSS

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| outputlookup employee_boss.csv
| lookup employee_boss.csv EMPLOYEE AS BOSS OUTPUT BOSS AS BOSS2
| lookup employee_boss.csv EMPLOYEE AS BOSS2 OUTPUT BOSS AS BOSS3
| lookup employee_boss.csv EMPLOYEE AS BOSS3 OUTPUT BOSS AS BOSS4

View solution in original post

woodcock
Esteemed Legend

Like this:

| makeresults 
| eval raw="EMPLOYEE=ERIC,BOSS=CHRIS EMPLOYEE=CHRIS,BOSS=MACK EMPLOYEE=MACK,BOSS=VAL EMPLOYEE=VAL,BOSS=WILL"
| makemv raw
| mvexpand raw
| rename raw AS _raw
| kv
| table EMPLOYEE BOSS

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| outputlookup employee_boss.csv
| lookup employee_boss.csv EMPLOYEE AS BOSS OUTPUT BOSS AS BOSS2
| lookup employee_boss.csv EMPLOYEE AS BOSS2 OUTPUT BOSS AS BOSS3
| lookup employee_boss.csv EMPLOYEE AS BOSS3 OUTPUT BOSS AS BOSS4

eddy_liao
Engager

Thanks this works beautifully

0 Karma

woodcock
Esteemed Legend

Be sure to come back and click Accept to close the question.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...