Hello there,
Is there a way to address all fields case insensitively.
To illustrate my point I have this query,
index=*aws_config* resourceType="AWS::EC2::Volume"
| eval tag_CostCenter=If(isnotnull('tags.Brand.CostCenter') OR isnotnull('tags.brand.costcenter') OR isnotnull('tags.brand.Costcenter' OR isnotnull('tags.brand.costCenter' OR isnotnull('tags.brand.COSTCENTER' OR isnotnull('tags.brand.costCENTER'), "Yes", "No")
My data can have fields CostCenter, costCenter, COSTCENTER and many other case variations (And there can be tens of variations). Currently I am handling them by separating each variation with an OR. Is there a way to collectively query on all such case variations of a a field name instead of using multiple OR clauses.
I know we can use coalesce or field aliases but that still means that I need to specify all possible field names somewhere.
Thanks.
first, make table
and use transpose
and lower
index=*aws_config* resourceType="AWS::EC2::Volume"
| table tags*
| transpose 0 column_name=tags
| eval tags=lower(tags)
so, aggregate these bystats
...