Splunk Search

Can I search with case insensitive fields.

iet_ashish
Explorer

Hello there,

Is there a way to address all fields case insensitively.
To illustrate my point I have this query,

index=*aws_config* resourceType="AWS::EC2::Volume" 
| eval tag_CostCenter=If(isnotnull('tags.Brand.CostCenter') OR isnotnull('tags.brand.costcenter') OR isnotnull('tags.brand.Costcenter' OR isnotnull('tags.brand.costCenter' OR isnotnull('tags.brand.COSTCENTER' OR isnotnull('tags.brand.costCENTER'), "Yes", "No")

My data can have fields CostCenter, costCenter, COSTCENTER and many other case variations (And there can be tens of variations). Currently I am handling them by separating each variation with an OR. Is there a way to collectively query on all such case variations of a a field name instead of using multiple OR clauses.
I know we can use coalesce or field aliases but that still means that I need to specify all possible field names somewhere.

Thanks.

0 Karma

to4kawa
Ultra Champion

first, make table and use transpose and lower

 index=*aws_config* resourceType="AWS::EC2::Volume" 
| table tags*
| transpose 0 column_name=tags
| eval tags=lower(tags)

so, aggregate these bystats ...

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...