Splunk Search

Merge raws based on common substring

gaglimax
Loves-to-Learn Lots

Hi,

Let's imagine I have those raws :

NameValue1Value2
foo12
foo1216
foodazd56
fooaoke43
foo5623
bar12
barjodpez74
barjo74
bar12575

 

I would like to create a search that gives :

Name

Value1

Value2

foo

foo12

foodazd

fooaoke

foo56

1

2

4

5

2

3

6

bar

barjodpez

barjo

bar125

1

7

2

4

5

 

So to explain with words, I want to merge raws based on the smallest common substring present in the Name column (here, foo and bar).

Thanks for your help.

Labels (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Developer Spotlight with Mika Borner

From Hackathon Winner to Enterprise Leader    Mika Borner, CEO and Founder of Datapunctum AG, has been ...

Continue Your Federation Journey: Join Session 3 of the Bootcamp Series

To help practitioners build a stronger foundation, we launched the Data Management & Federation ...