How to standardize similar words?

[aa0]

Hi all,

I have two similar words that giving the same meaning. How can I standardize them into one value to prevent inconsistencies in result but at the same time keep initial subcontent for both words?

Here's the detail:

app= AOutlook, Outlook..etc

index=XXX app=XX...| eval Outlook=mvappend(AOutlook, Outlook)|table app action...

expected result:

app           |   action ....

Outlook       Not found

Outlook       Completed

previous query for append doesn't work, any alternative will be appreciated!

[ITWhisperer]

Which "words" are you trying to "standardize"? Are the words values from a field e.g. app or field names?

It would be helpful if you could share some sample events (in a code block </>, anonymised of course).

[aa0]

Some of the app names consist inside the app category- for instance AOutlook and Outlook are basically represent the same category app name, hence I need both of the field names but only with filed1-Outlook field2-Outlook instead of field1-AOutlook field2-Outlook (standard name for both fields).

[ITWhisperer]

Please can you share some of your events?