How can I make my search against lookup table case insensitive?

[tromero3]

I have a search which is detecting when host stops sending logs, then the search does a lookup against my assets lookup table file which is a KV store lookup to fetch the bunit and priority of the particular asset. The search works when the capitalization matches between the search results and the lookup table, but if they do not match exactly it will not fetch the bunit or priority. How can I make my search case insensitive so that it is able to match regardless of capitalization?

This is my search:
| metadata type=hosts index=* | where relative_time(now(), "-1d") > lastTime | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time | lookup assets.csv nt_host AS host OUTPUTNEW priority AS priority,bunit AS bunit | rename Latest_Time AS "Last Time Reported"

Thank you!

[efavreau]

@tromero3
One way would be to evaluate your fields after your lookup and convert it to the same case. Most people evaluate to all lowercase. Example: | eval nt_host = lower(nt_host)

[starcher]

you should use the ES macro for assets not reference a csv directly. Referencing a file directly ALSO bypasses all lookup configuration like case insensitive.

https://docs.splunk.com/Documentation/ES/6.0.0/Admin/Verifyassetandidentitydata