Splunk query issue

[santosh11]

Dear All,

I have two columns Id and relationalId below is the sample of it.

Id CorrelationalId
1 2

2 3

3 4

i am looking to get as an output

RelatedCorrelationalId

1 2 3 4

Please can someone guide me on the above issue.

Regards,
Santosh

[493669]

@santosh11 Try below query-

| eval RelatedCorrelationalId = mvappend(Id, CorrelationalId)| stats count by RelatedCorrelationalId | table RelatedCorrelationalId

Below is using sample data-

|makeresults|eval Id="1", CorrelationalId="2"
|append[|makeresults|eval Id="2", CorrelationalId="3"]
|append[|makeresults|eval Id="3", CorrelationalId="4"]
|fields - _time| eval RelatedCorrelationalId = mvappend(Id, CorrelationalId)| stats count by RelatedCorrelationalId | table RelatedCorrelationalId

Let me know if it helps!

[santosh11]

I am trying that now will update you on the status. Thank you for the response.

[493669]

Can you explain How RelatedCorelationalId field is getting populated?

[santosh11]

Sorry for the inproper information.

Basically the RelatedCorrelationId is my required Output.

Where i need to get all the interlinked records of Id and corelationalId. Basically parent child relationship. i need to get all that records in one place.

Hope it explains.

Regards,
Santosh