hi, i am a newbie in Splunk here and i am not a native speaker, so please bare my grammar.
can someone explain how to correlate between two columns that is present in a table and remove the other values?
for example table below,
i want to correlate between the Number and Router, because one Number only belongs to one Router.
and the first digit of the Number is correlated to the R(1-7)
for example:
- Number 21938 belongs to SWW- R2 -896
- Number 12439 belongs to HIT- R1 -141
and i need to remove the other value that is not correlated, so there is only one Number, one IP Address and one Router in each row. so the proper table would look like below.
any answer and help would be really appreciated.
thank you.
....
|eval head_num=substr(NUMBER,1,1), head_r=substr(ROUTER,6,1)
| where head_num==head_r
Hi @mfirmanf,
could you share an example of your logs?
it's difficoult to help you whitout them.
Ciao.
Giuseppe