Hi There,
Any guidance on how to find common values starting with similar values from two different sources?
exp:
Source: 1 field:SerialId value: 123_abc
Source: 2 field: SerialId value: 123_abcde
so if the values start with the first common 6 letters and numbers-find those matching.
any advice on how to approach this?
Hi @Mary666
As per my understanding, you can use the field name and the value with the starting common character with a wildcard.
Source: 1
field:SerialId value: 123*
Source: 2
field: SerialId value: 123*
This will fetch the common values from that fields.
Example Screenprint:
Thanks
Thanks, but I should have been more detailed. The values can be numbers and letters and can be different in size. So basically I am trying to do this:
Index="123", team=green, ID=123Azz_mpr
Index="456" , team=blue, ID=123Cxx_1
Desired result:
ID=123
I have tried
| eval ShortMessage= substr(ID1,3) this does work, but it does not include the data for both indexes.
Try this,
index="123" OR index="456" (team=green OR team=blue) ID=123*