Splunk Search

Merge raws based on common substring

gaglimax
Loves-to-Learn Lots

Hi,

Let's imagine I have those raws :

NameValue1Value2
foo12
foo1216
foodazd56
fooaoke43
foo5623
bar12
barjodpez74
barjo74
bar12575

 

I would like to create a search that gives :

Name

Value1

Value2

foo

foo12

foodazd

fooaoke

foo56

1

2

4

5

2

3

6

bar

barjodpez

barjo

bar125

1

7

2

4

5

 

So to explain with words, I want to merge raws based on the smallest common substring present in the Name column (here, foo and bar).

Thanks for your help.

Labels (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...