Technically, the problem you first described is solved - you have now described a different problem. You are trying to "join" events where the joining field values only partially match. Given your example, can you extract just the string you want to match on? For example, if you can assume that the id is made up of numbers, uppercase letters, minus and underscore, and sometimes preceded by an underscore, you could try something like this | makeresults
| eval field1=split("536456786786_454AS6DASD-98SAD-787RET-98SAD-GASDA54656|remote_splunk_.com_536456786786_454AS6DASD-98SAD-787RET-98SAD-GASDA54656","|")
| mvexpand field1
| streamstats count as source
| eval name="datafrom".source
| eval {name}=random()%10
| fields - name
| rex field=field1 max_match=0 "_?(?<id>[0-9A-Z_-]+)"
| eval id=mvindex(id,-1)
| stats values(*) as * by id
... View more
