Case Insensitive Join

[slee8812]

Hi,
Is it possible to perform a case insensitive join? The log files I'm working with have a field that contains values which begin with a prefix. The case of the prefix does not appear to be consistent but the rest of the string value is. Any help will be appreciated. Thank you.

Sam

[Ayn · Accepted solution]

You could change the case for the relevant fields before performing the join, using eval's lower() function. Something like:

... | eval myfield=lower(myfield) | join myfield [... | eval myfield=lower(myfield)]

[slee8812]

Thank you. Worked like a charm.