topic Re: Extracted Field to be case insensitive in Splunk Search

Extracted Field to be case insensitive

harshjets — Mon, 08 Apr 2013 09:27:44 GMT

Hi,
I have a
Event 1 : 2013-04-02 04:22:38 199.xx.x.211 OPTIONS /CockpitNew - 4444 domain1\123456 102.220.13.119 ebDAV-MiniRedir/6.1.7600 200 0 64 143
Event 2 : 2013-04-02 05:22:38 199.xx.x.211 OPTIONS /CockpitNew - 4444 DOMAIN1\123456 102.220.13.119 ebDAV-MiniRedir/6.1.7600 200 0 64 143
When I extract the Domain field: domain1 & DOMAIN1 come up separately.
I want both of them to be under the DOMAIN1 value.
How can I do it. The regular regex during field extraction doesn't let me.

Thanks

Re: Extracted Field to be case insensitive

martin_mueller — Mon, 08 Apr 2013 09:36:11 GMT

Regular expressions cannot do this. You can however define a calculated field that converts each value to upper case.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/definecalcfields

Re: Extracted Field to be case insensitive

andreac81 — Thu, 27 Apr 2017 14:38:53 GMT

I have the same problem, I have many fields extracted with regular expression that sometimes are uppercase, other times are lowercase.
I need to define a calculated field for each filed or is some way to define only one calculated field that converts all fields in uppercase?

Re: Extracted Field to be case insensitive

alemarzu — Thu, 27 Apr 2017 16:37:21 GMT

Try this andreac, working example just copy & paste code.

| makeresults 
| eval temp="2013-04-02 04:22:38 199.xx.x.211 OPTIONS /CockpitNew - 4444 domain1\123456 102.220.13.119 ebDAV-MiniRedir/6.1.7600 200 0 64 143"."#"."2013-04-02 05:22:38 199.xx.x.211 OPTIONS /CockpitNew - 4444 DOMAIN1\123456 102.220.13.119 ebDAV-MiniRedir/6.1.7600 200 0 64 143"
| makemv delim="#" temp
| mvexpand temp
| rex field=temp max_match=0 "(?)-\s[\d]+\s(?<IMINSENSITIVE>[^\s]+)\s[\d\.]+\s"
| eval IMINSENSITIVE=lower(IMINSENSITIVE)

Hope it helps.

Re: Extracted Field to be case insensitive

somesoni2 — Thu, 27 Apr 2017 18:10:54 GMT

You would need to create separate calculated field for each field whose value you want to change to upper case.