Answers for "How do I pair two fields that came from the same event?"
https://answers.splunk.com/answers/687049/how-do-i-pair-two-fields-that-came-from-the-same-e.html
The latest answers for the question "How do I pair two fields that came from the same event?"Answer by somesoni2
https://answers.splunk.com/answering/687090/view.html
Give this a try
your current search with fields problemType promblemLocation problem x
| eval problem=problem."##".x
| stats count by problemType promblemLocation problem
| table problemType promblemLocation problem
| rex field=problem "(?<problem>.+)##(?<x>.+)"
| stats list(problem) as problem list(x) as x by problemType problemLocationWed, 19 Sep 2018 17:55:53 GMTsomesoni2