https://community.splunk.com/t5/Splunk-Search/How-to-standardize-similar-words/m-p/626197#M217647 <P>Some of the app names consist inside the app category- for instance AOutlook and Outlook are basically represent the same category app name, hence I need both of the field names but only with filed1-Outlook field2-Outlook instead of field1-AOutlook field2-Outlook (standard name for both fields).</P><P>&nbsp;</P> Fri, 06 Jan 2023 14:36:45 GMT aa0 2023-01-06T14:36:45Z https://community.splunk.com/t5/Splunk-Search/How-to-standardize-similar-words/m-p/626162#M217637 <P>Hi all,</P><P>I have two similar words that giving the same meaning. How can I standardize them into one value to prevent inconsistencies in result but at the same time keep initial subcontent for both words?</P><P>Here's the detail:</P><P>app= AOutlook, Outlook..etc</P><P>index=XXX app=XX...| eval Outlook=mvappend(AOutlook, Outlook)|table app action...</P><P>expected result:</P><P>app&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;|&nbsp; &nbsp;action ....</P><P>Outlook&nbsp; &nbsp; &nbsp; &nbsp;Not found</P><P>Outlook&nbsp; &nbsp; &nbsp; &nbsp;Completed</P><P>previous query for append doesn't work, any alternative will be appreciated!</P> Fri, 06 Jan 2023 12:25:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-standardize-similar-words/m-p/626162#M217637 aa0 2023-01-06T12:25:09Z https://community.splunk.com/t5/Splunk-Search/How-to-standardize-similar-words/m-p/626179#M217645 <P>Which "words" are you trying to "standardize"? Are the words values from a field e.g. app or field names?</P><P>It would be helpful if you could share some sample events (in a code block &lt;/&gt;, anonymised of course).</P> Fri, 06 Jan 2023 13:52:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-standardize-similar-words/m-p/626179#M217645 ITWhisperer 2023-01-06T13:52:49Z https://community.splunk.com/t5/Splunk-Search/How-to-standardize-similar-words/m-p/626197#M217647 <P>Some of the app names consist inside the app category- for instance AOutlook and Outlook are basically represent the same category app name, hence I need both of the field names but only with filed1-Outlook field2-Outlook instead of field1-AOutlook field2-Outlook (standard name for both fields).</P><P>&nbsp;</P> Fri, 06 Jan 2023 14:36:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-standardize-similar-words/m-p/626197#M217647 aa0 2023-01-06T14:36:45Z https://community.splunk.com/t5/Splunk-Search/How-to-standardize-similar-words/m-p/626205#M217648 <P>Please can you share some of your events?</P> Fri, 06 Jan 2023 15:36:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-standardize-similar-words/m-p/626205#M217648 ITWhisperer 2023-01-06T15:36:46Z