Hello!
I am new in Splunk. I have a log that contains the chain of changing values. They contain a unique attribute that for security replaced by a temporary ID. The log contains a chain of changes in these temporary IDs. For example,
Time,UniqueID,TemporaryID,OldTemporaryID
20:22:12,3428743571,235ad,3468f
20:24:03,_,568df,235ad
20:27:52,_,fg945,568df
20:32:37,5829540735,ae478,362ab
20:35:10,_,12df3,ae478
20:36:02,_,fa569,fg945
There is a relationship between events with values TemporaryID - OldTemporaryID. I need to following up these chains replace "_" to the correct unique identifier. The result should look something like this:
Time,UniqueID,TemporaryID,OldTemporaryID
20:22:12,3428743571,235ad,3468f
20:24:03,3428743571,568df,235ad
20:27:52,3428743571,fg945,568df
20:32:37,5829540735,ae478,362ab
20:35:10,5829540735,12df3,ae478
20:36:02,3428743571,fa569,fg945
How can this be implemented? What should be a request for a search?
Thank you!