topic Re: Merge case sensitive and not case sensitive username event windows in Splunk Search

Merge case sensitive and not case sensitive username event windows

a5003976 — Thu, 08 Oct 2015 15:44:13 GMT

Hello,
thanks all in advance for your response.
Can i merge events of windows, in particular field User_Name, when there are multiple occurrences with upper and lower case in username?

For example:

DOMAIN\name or DOMAIN\NAME or DOMAIN\Name or DOMAIN\namE

i want to create a search (regex or other) that have as output a single result and not multiple results.

there is chance to get it?

Thanks.
Mark.

Re: Merge case sensitive and not case sensitive username event windows

richgalloway — Thu, 08 Oct 2015 16:33:15 GMT

You can normalize the field before displaying or processing it. For example,

... | eval User_Name=lower(User_Name) | stats count by User_Name | table User_name count

Re: Merge case sensitive and not case sensitive username event windows

a5003976 — Fri, 23 Oct 2015 11:48:53 GMT

Thanks richgalloway!!