(While) Loop function in search

[dvbeekcinq]

I'm currently facing an issue where I would solve it with a loop function in any programming language.

But I'm now trying to fix it in Splunk itself.

The example data:

alias, cname
a.domain.com, b.domain.com
b.domain.com, c.domain.com
c.domain.com, d.domain.com
y.domain.com, z.domain.com

As you can see in the last line, y.domain.com is an alias for z.domain.com. That's the simplest example, but the example in the first 3 lines is a bit more complex. As you can see a.domain.com is an alias for b.domain.com, but b.domain.com is also an alias for c.domain.com and c.domain.com is also an alias for d.domain.com. So you could resolve a.domain.com to d.domain.com. (logically, you find the cname that doesn't exist in the list of aliasses anymore).

Now I want to do this in a search.. Something I came up with:

| table alias cname
| join cname type=left overwrite=true [search host=x source=*crecords* | rename cname as nextcname | rename alias as cname]
| join nextcname type=left [search host=x source=*crecords* | rename alias as nextcname | rename cname as lastcname]
| table alias cname nextcname lastcname

That would give me the alias of a.domain.com mapping to lastcname of d.domain.com. But I want to loop this, because this stops working when there is another record in there mapping d.domain.com to e.domain.com for example.

Does anybody have an idea how to fix it? I've been banging my head for hours now.

[FrankVl]

This would call for some kind of recursive searching, which Splunk doesn't really support. See also previous similar questions: https://answers.splunk.com/topics/recursive-searching.html

Typical answers I see there are along the same approach you found already: use a bunch of joins to the level you are confident you have captured everything.

[dvbeekcinq]

Thanks FrankVI for your reply. I already thought that would be the case.

Do you know if something like a search macro, pointing itself is possible to fix this?

myMacro(1) where the argument would be the cname.
IF (cname IN list of al aliases) THEN find cname where alias is $arg1$
and run myMacro(found-cname) --> to find any other sub-levels
ELSE return cname

Thanks in advance!

[FrankVl]

Don't think you can define a macro that refers to itself.

One hack that might work is to do:

| eval pair=alias.";".cname
| eventstats values(pair)

So on each row you also have the full list of alias->cname pairs. And then build some custom search command / python backed lookup that does the recursive calculation. I guess with a custom search command you might even be able to do this without above eventstats trick.