Correlate value between 2 columns

mfirmanf — Mon, 13 Apr 2020 02:03:48 GMT

hi, i am a newbie in Splunk here and i am not a native speaker, so please bare my grammar.
can someone explain how to correlate between two columns that is present in a table and remove the other values?

for example table below,
i want to correlate between the Number and Router, because one Number only belongs to one Router.
and the first digit of the Number is correlated to the R(1-7)
for example:
- Number 21938 belongs to SWW- R2 -896
- Number 12439 belongs to HIT- R1 -141

and i need to remove the other value that is not correlated, so there is only one Number, one IP Address and one Router in each row. so the proper table would look like below.

any answer and help would be really appreciated.
thank you.

Re: Correlate value between 2 columns

gcusello — Mon, 13 Apr 2020 07:06:55 GMT

Hi @mfirmanf,
could you share an example of your logs?
it's difficoult to help you whitout them.

Ciao.
Giuseppe

Re: Correlate value between 2 columns

to4kawa — Mon, 13 Apr 2020 09:17:44 GMT

....
|eval head_num=substr(NUMBER,1,1), head_r=substr(ROUTER,6,1)
| where head_num==head_r

topic Re: Correlate value between 2 columns in Splunk Search

Correlate value between 2 columns

Re: Correlate value between 2 columns

Re: Correlate value between 2 columns