topic Re: What should be added to my search to convert all the results to be lower case? in Splunk Search

What should be added to my search to convert all the results to be lower case?

pavanae — Tue, 29 Sep 2020 16:21:15 GMT

I have a Splunk query as follows

| inputlookup hosts.csv | rename Hostname as my_hostname |rex mode=sed field=my_hostname "s/..*//g

Now what should be added to my query to convert all the results to be lower case.

Re: What should be added to my search to convert all the results to be lower case?

cmerriman — Thu, 19 Oct 2017 21:02:12 GMT

|eval my_hostname=lower(my_hostname)

http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/TextFunctions

Re: What should be added to my search to convert all the results to be lower case?

gcusello — Fri, 20 Oct 2017 12:13:56 GMT

Hi pavanae,
if I correctly understood:

| inputlookup hosts.csv 
| eval my_hostname=upper(Hostname) 
| rex mode=sed field=my_hostname "s/..*//g"

Bye.
Giuseppe

Re: What should be added to my search to convert all the results to be lower case?

kamlesh_vaghela — Fri, 20 Oct 2017 17:16:20 GMT

Hi pavanae,

can you please try it?

| foreach "*" [eval <<FIELD>>=lower('<<FIELD>>') ]

Thanks

Re: What should be added to my search to convert all the results to be lower case?

dflodstrom — Fri, 20 Oct 2017 21:45:20 GMT

This definitely works even if you just use lower(<<FIELD>>)

You could be silly and make everything lowercase too: | eval _raw=lower(_raw)

Re: What should be added to my search to convert all the results to be lower case?

dflodstrom — Fri, 20 Oct 2017 21:47:25 GMT

This is the easiest way to solve your specific issue.

Re: What should be added to my search to convert all the results to be lower case?

kamlesh_vaghela — Sat, 21 Oct 2017 14:59:16 GMT

Hi dflodstrom ,

Yes lower(<<FIELD>>) works but I don't think so | eval _raw=lower(_raw) will work on those fields which are extracting search time. All search time extraction will be done when search before the first Pipe (|) will execute. Even we change _raw after the first Pipe(|) the extracted fields will be the same.

For an example. Please check output of below search:

index=_internal   component=HTTPAuthManager | eval _raw=lower(_raw)  | stats  count by component, log_level,message

Thanks