Splunk Field Contains Another Field