Is it possible to force the results to be used in a report to be case insensitive? For example UDP and udp are shown as different items.
You can use the lower() (or upper()) function in an | eval command to normalize field values and report accordingly.
source=x userid=* | eval userid=lower(userid) | stats count by userid
View solution in original post