duplicate hostnames with different cases

[sneuser]

Hello,

How could we avoid duplicate reporting of the same host?

Hosts (≥ 3)
host Count Last Update
1 Testserver01 2,991,872 01/31/2012 15:23:06
2 TESTSERVER01 2,197,558 01/31/2012 15:23:09

cat /opt/splunk/lib/splunk/defaultdb/db/Hosts.data
0 3 5314043 1319567912 1328020085 1328020085
1 host::Testserver01 2991880 1319567912 1328020026 1328020026
2 host::TESTSERVER01 2197672 1322490713 1328020085 1328020085

Steffen

[lpolo]

You can use the upper() function. This function takes one string argument and returns the uppercase version. The lower() function also exists for returning the lowercase version.

Example:

|eval host=upper(host)

More information:
http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/CommonEvalFunctions

Cheers,
Lp

[sneuser]

In which config file you need to write this statement to make this permanent?