Reporting

Is it possible to force the results to be used in a report to be case insensitive? For example UDP and udp are shown as different items.

Splunk Employee
Splunk Employee

Is it possible to force the results to be used in a report to be case insensitive? For example UDP and udp are shown as different items.

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

You can use the lower() (or upper()) function in an | eval command to normalize field values and report accordingly.

source=x userid=* | eval userid=lower(userid) | stats count by userid

View solution in original post

Splunk Employee
Splunk Employee

You can use the lower() (or upper()) function in an | eval command to normalize field values and report accordingly.

source=x userid=* | eval userid=lower(userid) | stats count by userid

View solution in original post