I'm currently facing an issue where I would solve it with a loop function in any programming language. But I'm now trying to fix it in Splunk itself. The example data: alias, cname a.domain.com, b.domain.com b.domain.com, c.domain.com c.domain.com, d.domain.com y.domain.com, z.domain.com As you can see in the last line, y.domain.com is an alias for z.domain.com. That's the simplest example, but the example in the first 3 lines is a bit more complex. As you can see a.domain.com is an alias for b.domain.com, but b.domain.com is also an alias for c.domain.com and c.domain.com is also an alias for d.domain.com. So you could resolve a.domain.com to d.domain.com. (logically, you find the cname that doesn't exist in the list of aliasses anymore). Now I want to do this in a search.. Something I came up with: | table alias cname | join cname type=left overwrite=true [search host=x source=*crecords* | rename cname as nextcname | rename alias as cname] | join nextcname type=left [search host=x source=*crecords* | rename alias as nextcname | rename cname as lastcname] | table alias cname nextcname lastcname That would give me the alias of a.domain.com mapping to lastcname of d.domain.com. But I want to loop this, because this stops working when there is another record in there mapping d.domain.com to e.domain.com for example. Does anybody have an idea how to fix it? I've been banging my head for hours now. ... View more