Reporting

Is it possible to force the results to be used in a report to be case insensitive? For example UDP and udp are shown as different items.

zliu
Splunk Employee
Splunk Employee

Is it possible to force the results to be used in a report to be case insensitive? For example UDP and udp are shown as different items.

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You can use the lower() (or upper()) function in an | eval command to normalize field values and report accordingly.

source=x userid=* | eval userid=lower(userid) | stats count by userid

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

You can use the lower() (or upper()) function in an | eval command to normalize field values and report accordingly.

source=x userid=* | eval userid=lower(userid) | stats count by userid

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!