https://community.splunk.com/t5/Splunk-Search/Standardizing-field-values/m-p/294542#M88896 <P>I have field values that are the same as each other but in different cases.</P> <P>How can I standardize them to prevent inconsistencies in my results?</P> <P>Thank you,</P> Tue, 16 May 2017 01:12:58 GMT tanyongjin 2017-05-16T01:12:58Z https://community.splunk.com/t5/Splunk-Search/Standardizing-field-values/m-p/294542#M88896 <P>I have field values that are the same as each other but in different cases.</P> <P>How can I standardize them to prevent inconsistencies in my results?</P> <P>Thank you,</P> Tue, 16 May 2017 01:12:58 GMT https://community.splunk.com/t5/Splunk-Search/Standardizing-field-values/m-p/294542#M88896 tanyongjin 2017-05-16T01:12:58Z https://community.splunk.com/t5/Splunk-Search/Standardizing-field-values/m-p/294543#M88897 <P>I'm going to assume that you have some fields that contain both "No" and "no" as potential values.</P> <P>1) Before running a stats (or similar aggregation command), you should take each such field and apply either the upper or lower command to the field, such as </P> <PRE><CODE>| eval myfield = lower(myfield) | stats count by myfield </CODE></PRE> <P>2) When using a <CODE>rex</CODE> or <CODE>regex</CODE> or <CODE>match</CODE> command on the field, at the front of the regular expression, add the flag <CODE>"(?i)"</CODE> to do case-insensitive matching.</P> <PRE><CODE>| regex AnotherField="(?i)yes" </CODE></PRE> <P>which is equivalent to </P> <PRE><CODE>| regex AnotherField="(yes|yeS|yEs|yES|Yes|YeS|YEs|YES)" </CODE></PRE> Tue, 16 May 2017 02:08:44 GMT https://community.splunk.com/t5/Splunk-Search/Standardizing-field-values/m-p/294543#M88897 DalJeanis 2017-05-16T02:08:44Z