https://community.splunk.com/t5/Splunk-Search/case-sensitive-dedup/m-p/42962#M10102 <P>dedup IS case-sensitive. You can convince yourself but running this search: </P> <BLOCKQUOTE> <P>| stats count | eval foo="bar" | append [stats count | eval foo="BAR"] | table foo | dedup foo</P> </BLOCKQUOTE> Tue, 25 Oct 2011 19:42:15 GMT carasso 2011-10-25T19:42:15Z https://community.splunk.com/t5/Splunk-Search/case-sensitive-dedup/m-p/42961#M10101 <P>I have two hosts, one named lower case 'server01', the other named upper case 'SERVER01'. When I do a search such as "foo | dedup host", I only get either server01 or SERVER01, and never both, because apparently dedup is performing case insensitive comparisons. Is there a way to enable case sensitivity?</P> <P>Thanks much in Advance.</P> Thu, 14 Jul 2011 18:56:15 GMT https://community.splunk.com/t5/Splunk-Search/case-sensitive-dedup/m-p/42961#M10101 blee_i365 2011-07-14T18:56:15Z https://community.splunk.com/t5/Splunk-Search/case-sensitive-dedup/m-p/42962#M10102 <P>dedup IS case-sensitive. You can convince yourself but running this search: </P> <BLOCKQUOTE> <P>| stats count | eval foo="bar" | append [stats count | eval foo="BAR"] | table foo | dedup foo</P> </BLOCKQUOTE> Tue, 25 Oct 2011 19:42:15 GMT https://community.splunk.com/t5/Splunk-Search/case-sensitive-dedup/m-p/42962#M10102 carasso 2011-10-25T19:42:15Z