Splunk Search

Recursively Search Until Condition

Path Finder


I am looking for a way to connection multiple events with two corresponding values together until I hit a condition of where there isn't a second corresponding value. Let me explain further. The data might look like this:

Event 1: current=1 new=2
Event 2: current=2 new=3
Event 3: current=3 new=4
Event 10: current=10 new=null

What I am looking to do is get to Event 10 from Event 1 and end with the value of 10. Basically this is a situation where an event might be the updating of an id, and only in that event is there a connection between the old id and the new id. This can happen several times and so in order to track the whole picture in splunk, I will need to start at the beginning and chain together all the events until I get to the event where the "new" id is nothing thus telling me that I'm at the end.

Any help or insight to this problem would be much appreciated.

Thank you for your help!

0 Karma


You may want to take a look at the transaction command and the options "startswith" and "endswith".

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...