https://community.splunk.com/t5/Splunk-Search/help-me-with-group-command/m-p/352537#M104357 <P>You would need to change the case of field UserName to either all upper or all lower before grouping</P> <PRE><CODE>--------| eval UserName=upper(UserName) | transaction UserName |dedup ID| table UserName ID </CODE></PRE> Thu, 27 Apr 2017 18:30:34 GMT somesoni2 2017-04-27T18:30:34Z https://community.splunk.com/t5/Splunk-Search/help-me-with-group-command/m-p/352536#M104356 <P>--------| transaction UserName |dedup ID| table UserName ID</P> <P>UserName ID<BR /> abc 100<BR /> ..... 103 </P> <P>Abc 101</P> <P>xyz 200</P> <P>Xyz 201</P> <P>i want to group it by userName where abc and Abc are same user</P> Thu, 27 Apr 2017 18:01:18 GMT https://community.splunk.com/t5/Splunk-Search/help-me-with-group-command/m-p/352536#M104356 sravankaripe 2017-04-27T18:01:18Z https://community.splunk.com/t5/Splunk-Search/help-me-with-group-command/m-p/352537#M104357 <P>You would need to change the case of field UserName to either all upper or all lower before grouping</P> <PRE><CODE>--------| eval UserName=upper(UserName) | transaction UserName |dedup ID| table UserName ID </CODE></PRE> Thu, 27 Apr 2017 18:30:34 GMT https://community.splunk.com/t5/Splunk-Search/help-me-with-group-command/m-p/352537#M104357 somesoni2 2017-04-27T18:30:34Z