You are right, SPL does not do recursion or loops particularly well. However, if you know the maximum depth, you could use repetition | makeresults
| fields - _time
| eval _raw="from to
A B
A C
A D
B E
B F
B G
F K
F L
C H
D I
D J
J M"
| multikv forceheader=1
| table from to
| eval path=from."-".to
| eventstats values(path) as paths
| foreach mode=multivalue paths
[| eval path=if(mvindex(split(<<ITEM>>,"-"),-1)==from,<<ITEM>>."-".to,path)]
| eventstats values(path) as paths
| foreach mode=multivalue paths
[| eval path=if(mvindex(split(<<ITEM>>,"-"),-1)==from,<<ITEM>>."-".to,path)]
| eventstats values(path) as paths
| foreach mode=multivalue paths
[| eval path=if(mvindex(split(<<ITEM>>,"-"),-1)==from,<<ITEM>>."-".to,path)] The last two lines are repeated sufficient times to resolve all paths.
... View more