Good afternoon, I've got a quite hard task to solve with SPL. Here are JSON data: {"name":"A", "pairs":["A","B"]}, {"name":"B", "pairs":["B","C"]}, {"name":"C", "pairs":["C","B"]}, {"name":"D", "pairs":["D","E"]}, {"name":"E", "pairs":["D","E"]} Each JSON object is event Name - is name of object Pairs - are reference to other objects Expected input: The person write as input name=A Expected output: Splunk will return all related events referenced by pairs and will search recursively by pairs so results will be: // 1. raw event {"name":"A", "pairs":["A","B"]} // 2. raw event {"name":"B", "pairs":["B","C"]} // 3. raw event {"name":"C", "pairs":["C","B"]} Alternative results: It will be OK if Splunk will return joined mv field with values : pairs = ["A","B","C"] // pairs as multi value field with values A B and C Is this possible to get such result with single SPL query? ... View more