rex to combine result

indeed_2000 — Sun, 30 Jan 2022 13:40:34 GMT

Hi
I have two field that extract send & rec like this:

| rex "S\[(?<SEND>\w+\.\w+)" | rex "R\[(?<REC>\w+\.\w+)"

now have 2 query like this:

|table SEND count
SERVER1.HUB 10

|table REC count
HUB.SERVER1 50

need to combine them and excpected result is a sankey diagram like this:

SERVER1(10)> HUB(50) >SERVER1

FYI: comon value between result string is HUB.

any idea?

Thanks,

topic rex to combine result in Splunk Search