$ 0 0 How to make splunk join with multiple to 1 record where one source is in json format and other one is string?