Is it possible to force the results to be used in a report to be case insensitive? For example UDP and udp are shown as different items.

[zliu]

Is it possible to force the results to be used in a report to be case insensitive? For example UDP and udp are shown as different items.

[gkanapathy · Accepted solution]

You can use the lower() (or upper()) function in an | eval command to normalize field values and report accordingly.

source=x userid=* | eval userid=lower(userid) | stats count by userid