Splunk Search

How to do hierarchy query?

jojujose
New Member

For simplicity sake, my data definition looks like: (FileId,ObjectId,ParentObjectId)
My data sample may look like:
f1,o1,null
f1,o1,null
f1,o2,o1
f1,o3,o2
I am basically trying to see something like this in the o/p..
Max depth in hierarchy for the above data set will be 2 (since, o3->o2->o1)
Also, I am interested in looking at the depth across fileIds..like a group by of the above results over fileIds
Any help in this will be appreciated!

0 Karma

sundareshr
Legend

Install the Splunk 6.x Dashboard Examples App and look at the Sankey Chart. Its a custom visualization for hierarchical data.

0 Karma

rafamss
Contributor

Hi jojujose,

With base in your sample, I believe that you need use the transaction command for this. This command classify the start and end of each event.

Veja se isto ajuda: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

[]s
RM

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...