Merge using a special logic

[twjack]

I need to merge the following examples from a multivalue field using a special logic. I have absolutely no idea how to do that and need some input here.

A logic could be: eval/Merge if next mv entry is in length +1

examples:

w
wh
wha
what
whats
whats a
whats ap
whats app

Should be: "whats app"

w
we
web
web.
web.de

Should be:
"web."
"web.de"

My current search from which the examples originate:

index=proxy url="*/search?q=*" url_domain="*.google.com"
| eval url = urldecode(url)
| rex field=url "q=(?P<search_terms>.*)"
| eval search_terms=replace(mvindex(split(search_terms,"&"),0),"\+"," ")
| eval search_engine="Google"
| stats earliest(_time) as earliest, latest(_time) as latest, values(search_terms) as search_terms by src search_engine

[FrankVl]

Your examples are nice and clean, but I cannot imagine your actual data will look like that and I don't really follow the logic you're trying to apply. What is it that you want to achieve with this in the end?

What happens when your set of search terms is this:

a
bb
ccc
dddd
whats
whats a
whats ap
whats app

Should those also all be merged into "whats app"?

And conceptually: what does the search term "we" have in common with the search term "web.de" that makes you want to merge them?

[renjith_nair]

Try this and let me know if it works. Sample output with other fields will help to fine tune

 index=proxy url="*/search?q=*" url_domain="*.google.com"
 | eval url = urldecode(url)
 | rex field=url "q=(?P<search_terms>.*)"
 | eval search_terms=replace(mvindex(split(search_terms,"&"),0),"\+"," ")
 | eval search_engine="Google"
 | stats earliest(_time) as earliest, latest(_time) as latest, values(search_terms) as search_terms by src search_engine
 | eval total=mvcount(search_terms)
 | mvexpand search_terms|eval length=len(search_terms)| delta length as difference| fillnull value=0
 | streamstats count by src,search_engine reset_on_change=true |where difference > 1 OR count==total