https://community.splunk.com/t5/Splunk-Search/Can-I-search-with-case-insensitive-fields/m-p/480730#M134694 <P>Hello there,</P> <P>Is there a way to address all fields case insensitively.<BR /> To illustrate my point I have this query,</P> <PRE><CODE>index=*aws_config* resourceType="AWS::EC2::Volume" | eval tag_CostCenter=If(isnotnull('tags.Brand.CostCenter') OR isnotnull('tags.brand.costcenter') OR isnotnull('tags.brand.Costcenter' OR isnotnull('tags.brand.costCenter' OR isnotnull('tags.brand.COSTCENTER' OR isnotnull('tags.brand.costCENTER'), "Yes", "No") </CODE></PRE> <P>My data can have fields CostCenter, costCenter, COSTCENTER and many other case variations (And there can be tens of variations). Currently I am handling them by separating each variation with an OR. Is there a way to collectively query on all such case variations of a a field name instead of using multiple OR clauses.<BR /> I know we can use coalesce or field aliases but that still means that I need to specify all possible field names somewhere.</P> <P>Thanks.</P> Mon, 20 Apr 2020 08:42:26 GMT iet_ashish 2020-04-20T08:42:26Z https://community.splunk.com/t5/Splunk-Search/Can-I-search-with-case-insensitive-fields/m-p/480730#M134694 <P>Hello there,</P> <P>Is there a way to address all fields case insensitively.<BR /> To illustrate my point I have this query,</P> <PRE><CODE>index=*aws_config* resourceType="AWS::EC2::Volume" | eval tag_CostCenter=If(isnotnull('tags.Brand.CostCenter') OR isnotnull('tags.brand.costcenter') OR isnotnull('tags.brand.Costcenter' OR isnotnull('tags.brand.costCenter' OR isnotnull('tags.brand.COSTCENTER' OR isnotnull('tags.brand.costCENTER'), "Yes", "No") </CODE></PRE> <P>My data can have fields CostCenter, costCenter, COSTCENTER and many other case variations (And there can be tens of variations). Currently I am handling them by separating each variation with an OR. Is there a way to collectively query on all such case variations of a a field name instead of using multiple OR clauses.<BR /> I know we can use coalesce or field aliases but that still means that I need to specify all possible field names somewhere.</P> <P>Thanks.</P> Mon, 20 Apr 2020 08:42:26 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-search-with-case-insensitive-fields/m-p/480730#M134694 iet_ashish 2020-04-20T08:42:26Z https://community.splunk.com/t5/Splunk-Search/Can-I-search-with-case-insensitive-fields/m-p/480731#M134695 <P>first, make <CODE>table</CODE> and use <CODE>transpose</CODE> and <CODE>lower</CODE></P> <PRE><CODE> index=*aws_config* resourceType="AWS::EC2::Volume" | table tags* | transpose 0 column_name=tags | eval tags=lower(tags) </CODE></PRE> <P>so, aggregate these by<CODE>stats</CODE> ...</P> Mon, 20 Apr 2020 09:53:33 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-search-with-case-insensitive-fields/m-p/480731#M134695 to4kawa 2020-04-20T09:53:33Z