https://community.splunk.com/t5/Splunk-Search/Case-Insensitive-Join/m-p/47835#M11410 <P>Hi,<BR /> Is it possible to perform a case insensitive join? The log files I'm working with have a field that contains values which begin with a prefix. The case of the prefix does not appear to be consistent but the rest of the string value is. Any help will be appreciated. Thank you.</P> <P>Sam</P> Thu, 10 May 2012 07:08:32 GMT slee8812 2012-05-10T07:08:32Z https://community.splunk.com/t5/Splunk-Search/Case-Insensitive-Join/m-p/47835#M11410 <P>Hi,<BR /> Is it possible to perform a case insensitive join? The log files I'm working with have a field that contains values which begin with a prefix. The case of the prefix does not appear to be consistent but the rest of the string value is. Any help will be appreciated. Thank you.</P> <P>Sam</P> Thu, 10 May 2012 07:08:32 GMT https://community.splunk.com/t5/Splunk-Search/Case-Insensitive-Join/m-p/47835#M11410 slee8812 2012-05-10T07:08:32Z https://community.splunk.com/t5/Splunk-Search/Case-Insensitive-Join/m-p/47836#M11411 <P>You could change the case for the relevant fields before performing the join, using <CODE>eval</CODE>'s <CODE>lower()</CODE> function. Something like:</P> <PRE><CODE>... | eval myfield=lower(myfield) | join myfield [... | eval myfield=lower(myfield)] </CODE></PRE> Thu, 10 May 2012 08:03:25 GMT https://community.splunk.com/t5/Splunk-Search/Case-Insensitive-Join/m-p/47836#M11411 Ayn 2012-05-10T08:03:25Z https://community.splunk.com/t5/Splunk-Search/Case-Insensitive-Join/m-p/47837#M11412 <P>Thank you. Worked like a charm.</P> Thu, 10 May 2012 18:46:22 GMT https://community.splunk.com/t5/Splunk-Search/Case-Insensitive-Join/m-p/47837#M11412 slee8812 2012-05-10T18:46:22Z