Minimizing relationships between objects

[pguillen_splunk]

Let's say I am using a visualization to map the relationships between different "objects" (my use case isn't IT specific but you could also call these "objects" devices), and up to this point my data looks like the table below. This table shows the connection from one object to another (A goes to B, B goes to C,etc.)

FROM	TO
A	B
B	C
C	D
X	C
Y	C
C	Z

Now, what I want to do in order to de-clutter my visualization is "collapse" paths based on the object. I've determined objects B and C are nonessential to my use case and would like minimize the map by relating A to D instead of A to B to C to D and X to Z instead of X to C to Z. So my final goal is for the table to look like:

FROM	TO
A	D
X	Z
Y	Z

Is it possible to structure a search to perform this transformation, or is the only solution to write a custom search command?

[gcusello]

Hi @pguillen_splunk,

is it possible adding a condition to your main search?

your_search NOT (FROM="B" OR FROM="C" OR TO="B" OT TO="C")
| ...

 Ciao.

Giuseppe