Splunk Search

Merge raws based on common substring

gaglimax
Loves-to-Learn Lots

Hi,

Let's imagine I have those raws :

NameValue1Value2
foo12
foo1216
foodazd56
fooaoke43
foo5623
bar12
barjodpez74
barjo74
bar12575

 

I would like to create a search that gives :

Name

Value1

Value2

foo

foo12

foodazd

fooaoke

foo56

1

2

4

5

2

3

6

bar

barjodpez

barjo

bar125

1

7

2

4

5

 

So to explain with words, I want to merge raws based on the smallest common substring present in the Name column (here, foo and bar).

Thanks for your help.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...