Sorry I didn't realize the string of interest was in value. (There was a big discussion about field name recently.) If so, regex is appropriate. This should work | eventstats values(name) as le...
See more...
Sorry I didn't realize the string of interest was in value. (There was a big discussion about field name recently.) If so, regex is appropriate. This should work | eventstats values(name) as left_name
| eval match_name = mvmap(left_name, mvappend(match_name, if(match(NAME, "^(.+_)*" . left_name . "_"), left_name, null())))
| eval joined = coalesce(name, match_name)
| fields - *name NAME
| stats values(*) as * by joined Here I use joined instead of joined_name just to make field cleanup easier. Here is some mock data: NAME left_data_var name right_data_var leftbar1 RU3NDS leftbar1 SOMETHING leftbar2 ELSE RU3NDS_abcd rightbar1 RU3NDS_efgh rightbar3 A_SOMETHING_abcd rightbar2 SOMETHING_efgh rightbar1 ELSE_bcde rightbar2 A_RU3NDS_cdef rightbar3 The result is joined left_data_var right_data_var ELSE leftbar2 rightbar2 RU3NDS leftbar1 rightbar1 rightbar3 SOMETHING leftbar1 rightbar1 rightbar2 It is really important to illustrate data and desired output when asking a data analytics question. You could have saved everyone lots of time guessing. This is a full emulation | makeresults format=csv data="name, left_data_var
RU3NDS, leftbar1
SOMETHING, leftbar1
ELSE, leftbar2"
| append
[makeresults format=csv data="NAME, right_data_var
RU3NDS_abcd, rightbar1
RU3NDS_efgh, rightbar3
A_SOMETHING_abcd, rightbar2
SOMETHING_efgh, rightbar1
ELSE_bcde, rightbar2
A_RU3NDS_cdef, rightbar3"]
``` data emulation above ```
| eventstats values(name) as left_name
| eval match_name = mvmap(left_name, mvappend(match_name, if(match(NAME, "^(.+_)*" . left_name . "_"), left_name, null())))
| eval joined = coalesce(name, match_name)
| fields - *name NAME
| stats values(*) as * by joined