topic Re: Combining Rows from Case-Insensitive search with multiple results? in Splunk Search

Combining Rows from Case-Insensitive search with multiple results?

mcrawford44 — Mon, 28 Sep 2020 15:18:54 GMT

When searching an index for "foo", multiple results are returned as so;

Ex. index=blah machine_domain=foo | stats count by machine_domain

foo     1
Foo     2
FOO     3

How would one combine the rows and counts?

Re: Combining Rows from Case-Insensitive search with multiple results?

somesoni2 — Tue, 19 Nov 2013 17:44:29 GMT

You can decide on which case to display the machine_domain (I have used upper) and then use below command.

index=blah machine_domain=foo | eval machine_domain=upper(machine_domain)| stats count by machine_domain

Re: Combining Rows from Case-Insensitive search with multiple results?

mcrawford44 — Tue, 19 Nov 2013 17:47:57 GMT

That worked, and combined the counts. Could you possibly elaborate on how this works to combine the results? It reads like all it's going to do is capitalize the initial search.

Re: Combining Rows from Case-Insensitive search with multiple results?

somesoni2 — Mon, 28 Sep 2020 15:18:56 GMT

Yes...the answer I provided is showing all the data/count, its the just how/which case the machine_name will be displayed, you have to decide. Your can upper or lower (in eval command) for the same. So if you want final output as "foo....6", use "|eval machine_domain=lower(machine_name)".