Another oil change and another blog post. Good thing there
isn’t always a relationship between those two things or my cars wouldn’t be
running. Figured I would spend a minute talking about one of my new favorite
Splunk tricks. I think I ran across this in the Implementing Splunk book but
then could never find again. Was pleased that it showed up in the Advanced
Searching and Reporting class I took at .conf2013 (great class BTW). The trick
relates to formatting data and covers a variety of use cases mostly related to
displaying a one to many relationship at various levels of granularity.