Splunk Search

Merge raws based on common substring

gaglimax
Loves-to-Learn Lots

Hi,

Let's imagine I have those raws :

NameValue1Value2
foo12
foo1216
foodazd56
fooaoke43
foo5623
bar12
barjodpez74
barjo74
bar12575

 

I would like to create a search that gives :

Name

Value1

Value2

foo

foo12

foodazd

fooaoke

foo56

1

2

4

5

2

3

6

bar

barjodpez

barjo

bar125

1

7

2

4

5

 

So to explain with words, I want to merge raws based on the smallest common substring present in the Name column (here, foo and bar).

Thanks for your help.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...