Minimizing relationships between objects

pguillen_splunk — Mon, 24 Aug 2020 20:08:19 GMT

Let's say I am using a visualization to map the relationships between different "objects" (my use case isn't IT specific but you could also call these "objects" devices), and up to this point my data looks like the table below. This table shows the connection from one object to another (A goes to B, B goes to C,etc.)

FROM	TO
A	B
B	C
C	D
X	C
Y	C
C	Z

Now, what I want to do in order to de-clutter my visualization is "collapse" paths based on the object. I've determined objects B and C are nonessential to my use case and would like minimize the map by relating A to D instead of A to B to C to D and X to Z instead of X to C to Z. So my final goal is for the table to look like:

FROM	TO
A	D
X	Z
Y	Z

Is it possible to structure a search to perform this transformation, or is the only solution to write a custom search command?

Re: Minimizing relationships between objects

gcusello — Tue, 25 Aug 2020 06:15:51 GMT

Hi @pguillen_splunk,

is it possible adding a condition to your main search?

your_search NOT (FROM="B" OR FROM="C" OR TO="B" OT TO="C") | ...

Ciao.

Giuseppe

topic Minimizing relationships between objects in Splunk Search

Minimizing relationships between objects

Re: Minimizing relationships between objects