Splunk Search

Case Insensitive Join

Engager

Hi,
Is it possible to perform a case insensitive join? The log files I'm working with have a field that contains values which begin with a prefix. The case of the prefix does not appear to be consistent but the rest of the string value is. Any help will be appreciated. Thank you.

Sam

Tags (1)
1 Solution

Legend

You could change the case for the relevant fields before performing the join, using eval's lower() function. Something like:

... | eval myfield=lower(myfield) | join myfield [... | eval myfield=lower(myfield)]

View solution in original post

Legend

You could change the case for the relevant fields before performing the join, using eval's lower() function. Something like:

... | eval myfield=lower(myfield) | join myfield [... | eval myfield=lower(myfield)]

View solution in original post

Engager

Thank you. Worked like a charm.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!