https://community.splunk.com/t5/Splunk-Search/Dedup-case-insensitive/m-p/309908#M92999 <P>When searching in our list of usernames that have logged in, I dedup the usernames but the results are case sensitive.<BR /> For example I have <STRONG>user01</STRONG> and <STRONG>User01</STRONG> both showing in the search results.</P> <P>How do I make the dedup case insensitive so that it will only show one of these results?</P> Fri, 23 Feb 2018 10:38:16 GMT gascoynt 2018-02-23T10:38:16Z https://community.splunk.com/t5/Splunk-Search/Dedup-case-insensitive/m-p/309908#M92999 <P>When searching in our list of usernames that have logged in, I dedup the usernames but the results are case sensitive.<BR /> For example I have <STRONG>user01</STRONG> and <STRONG>User01</STRONG> both showing in the search results.</P> <P>How do I make the dedup case insensitive so that it will only show one of these results?</P> Fri, 23 Feb 2018 10:38:16 GMT https://community.splunk.com/t5/Splunk-Search/Dedup-case-insensitive/m-p/309908#M92999 gascoynt 2018-02-23T10:38:16Z https://community.splunk.com/t5/Splunk-Search/Dedup-case-insensitive/m-p/309909#M93000 <P>As far as I can see in the search reference for the dedup command, it has no way to make it case insensitive, so the only solution I see is before doing a dedup on username, change it to lowercase:</P> <PRE><CODE>| eval username=lower(username) </CODE></PRE> Fri, 23 Feb 2018 10:48:33 GMT https://community.splunk.com/t5/Splunk-Search/Dedup-case-insensitive/m-p/309909#M93000 FrankVl 2018-02-23T10:48:33Z