Find common values starting with

[Mary666]

Hi There,

Any guidance on how to find common values starting with similar values from two different sources?

exp:

Source: 1 field:SerialId value: 123_abc

Source:  2 field: SerialId value: 123_abcde

so if the values start with the first common 6 letters and numbers-find those matching.

any advice on how to approach this?

[vhharanpositka]

Hi @Mary666 

As per my understanding, you can use the field name and the value with the starting common character with a wildcard.

Source: 1

field:SerialId value: 123*

Source:  2

field: SerialId value: 123*

This will fetch the common values from that fields.

Example Screenprint:

Thanks

[Mary666]

Thanks, but I should have been more detailed. The values can be numbers and letters and can be different in size. So basically I am trying to do this:

Index="123", team=green, ID=123Azz_mpr

Index="456" , team=blue, ID=123Cxx_1


Desired result: 
ID=123

I have tried 
| eval ShortMessage= substr(ID1,3)  this does work, but it does not include the data for both indexes. 

[vhharanpositka]

Try this,

index="123" OR index="456" (team=green OR  team=blue) ID=123*