Reporting

Is it possible to force the results to be used in a report to be case insensitive? For example UDP and udp are shown as different items.

Splunk Employee
Splunk Employee

Is it possible to force the results to be used in a report to be case insensitive? For example UDP and udp are shown as different items.

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

You can use the lower() (or upper()) function in an | eval command to normalize field values and report accordingly.

source=x userid=* | eval userid=lower(userid) | stats count by userid

View solution in original post

Splunk Employee
Splunk Employee

You can use the lower() (or upper()) function in an | eval command to normalize field values and report accordingly.

source=x userid=* | eval userid=lower(userid) | stats count by userid

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!