If there's no further information in the layout, then there's no way to accurately give you what you want. With regard to the nodes, there is no way to distinguish between the Port and the NIC. Both have the same parent and no children.
What other information is present in the nodes?
So that the community can help you with this, I'm providing the following "run anywhere code" to create test data. It creates four layouts, a through d, that match your nodes.
| eval myfields="Block Compute CPURack CPU FAN Core Network Chassis Port NIC SubChassis"
| makemv myfields
| eval mydata="a10!a20!a30!a40!a41!a50!a60!a70!a71!a72!a80 b10!b20!b30!b40!b41!b50!b60!b70!b71!b72!b80 c10!c20!c30!c40!c41!c50!c60!c70!c71!c72!c80 d10!d20!d30!d40!d41!d50!d60!d70!d71!d72!d80"
| makemv mydata
| mvexpand mydata
| makemv delim="!" mydata
| eval compName=mvzip(myfields,mydata,"=")
| eval mylinks="10,7 9,6 8,6 7,6 6,0 5,3 4,2 3,2 2,1 1,0 0,0" | makemv mylinks | mvexpand mylinks
| makemv delim="," mylinks
| eval dbid=mvindex(mydata,tonumber(mvindex(mylinks,0)))
| eval parentdbid=mvindex(mydata,tonumber(mvindex(mylinks,1)))
| eval parentdbid=if(parentdbid=dbid,null(),parentdbid)
| eval compName=mvindex(compName,tonumber(mvindex(mylinks,0)))
| sort 0 dbid
| table dbid parentdbid compName
With different letters for each set of events, the output looks like this
dbid parentdbid compName
a20 a10 Compute=a20
a30 a20 CPURack=a30
a40 a30 CPU=a40
a41 a30 FAN=a41
a50 a40 Core=a50
a60 a10 Network=a60
a70 a60 Chassis=a70
a71 a60 Port=a71
a72 a60 NIC=a72
a80 a70 SubChassis=a80
... View more
I probably am very beginner in splunk but as a splunk app developer, Ideally "Verbose mode and fast mode should produce same result" and if not by xyz reason then I am certainly looking for a way to pass search mode from my dashboard chart to explicitly search on verbose mode.
adding to that we have at least two report of same issue already on answers.splunk.com and even that developer has fixed the issue like me (explicitly extracting field)
If whatever I said make sense and worth investigating then can you guys please file a splunk bug here and let me know if I can continue with my query with cLabel=* ? and when would the fix be available
please correct me if I am making any mistake here. You guys have better splunk understanding and insight than me
Thanks and Best Regards
- Shreyans Soni
... View more