title: Splunk match partial result value of field and compare results
body: <p>I have 3 fields in my splunk result like message, id and docId. 
  Need to group the results by id and doc id which has specific messages</p>
  
  <pre><code>message="successfully added" id=1234 docId =1345
  message="removed someUniqueId" id=1234 docId =1345
  </code></pre>
  
  <p>I have to group based on the results by both id's which has the specific message</p>
  
  <pre><code> search query | rex "message=(?&lt;message[\S\s]*&gt;)" | where message="successfully added"
  </code></pre>
  
  <p>which is giving result for the first search, when i tried to search for second search query which is not giving result due to the someUniqueId" </p>
  
  <pre><code> search query | rex "message=(?&lt;message[\S\s]*&gt;)" | where match(message, "removed *")
  </code></pre>
  
  <p>Could you pelase help me to filter the results which has the 2 messages and group by id and docID</p>