https://community.splunk.com/t5/Getting-Data-In/duplicate-hostnames-with-different-cases/m-p/61217#M12163 <P>Hello,</P> <P>How could we avoid duplicate reporting of the same host?</P> <P>Hosts (≥ 3)<BR /> host Count Last Update<BR /> 1 Testserver01 2,991,872 01/31/2012 15:23:06<BR /> 2 TESTSERVER01 2,197,558 01/31/2012 15:23:09</P> <P>cat /opt/splunk/lib/splunk/defaultdb/db/Hosts.data<BR /> 0 3 5314043 1319567912 1328020085 1328020085<BR /> 1 host::Testserver01 2991880 1319567912 1328020026 1328020026<BR /> 2 host::TESTSERVER01 2197672 1322490713 1328020085 1328020085</P> <P>Steffen</P> Tue, 31 Jan 2012 14:32:09 GMT sneuser 2012-01-31T14:32:09Z https://community.splunk.com/t5/Getting-Data-In/duplicate-hostnames-with-different-cases/m-p/61217#M12163 <P>Hello,</P> <P>How could we avoid duplicate reporting of the same host?</P> <P>Hosts (≥ 3)<BR /> host Count Last Update<BR /> 1 Testserver01 2,991,872 01/31/2012 15:23:06<BR /> 2 TESTSERVER01 2,197,558 01/31/2012 15:23:09</P> <P>cat /opt/splunk/lib/splunk/defaultdb/db/Hosts.data<BR /> 0 3 5314043 1319567912 1328020085 1328020085<BR /> 1 host::Testserver01 2991880 1319567912 1328020026 1328020026<BR /> 2 host::TESTSERVER01 2197672 1322490713 1328020085 1328020085</P> <P>Steffen</P> Tue, 31 Jan 2012 14:32:09 GMT https://community.splunk.com/t5/Getting-Data-In/duplicate-hostnames-with-different-cases/m-p/61217#M12163 sneuser 2012-01-31T14:32:09Z https://community.splunk.com/t5/Getting-Data-In/duplicate-hostnames-with-different-cases/m-p/61218#M12164 <P>You can use the upper() function. This function takes one string argument and returns the uppercase version. The lower() function also exists for returning the lowercase version.</P> <P>Example:</P> <P>|eval host=upper(host)</P> <P>More information:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/CommonEvalFunctions</A></P> <P>Cheers,<BR /> Lp</P> Tue, 31 Jan 2012 15:11:13 GMT https://community.splunk.com/t5/Getting-Data-In/duplicate-hostnames-with-different-cases/m-p/61218#M12164 lpolo 2012-01-31T15:11:13Z https://community.splunk.com/t5/Getting-Data-In/duplicate-hostnames-with-different-cases/m-p/61219#M12165 <P>In which config file you need to write this statement to make this permanent?</P> Tue, 31 Jan 2012 15:15:35 GMT https://community.splunk.com/t5/Getting-Data-In/duplicate-hostnames-with-different-cases/m-p/61219#M12165 sneuser 2012-01-31T15:15:35Z