Splunk Search

Case sensitivity of name, in name=value pairs

NK_1
Path Finder

I would like to do a "stats distinct_count(accountID)"

However, some code modules log "accountID=xxxx", while others log "AccountID=xxxx"

Is there a way to get a distinct count of Account IDs without having to change the code that does the logging?

1 Solution

southeringtonp
Motivator

As long as only one or the other is present, use coalesce:

| eval accountID=coalesce(accountID, AccountID)
| stats dc(accountID)

Another possibility would be to use rex. If, for example IDs are numeric:

| rex field=_raw "(?i)AccountID=(?<accountID>\d+)"

The rex approach is better if you need to deal with the possibility of multiple matches in one event.

View solution in original post

southeringtonp
Motivator

As long as only one or the other is present, use coalesce:

| eval accountID=coalesce(accountID, AccountID)
| stats dc(accountID)

Another possibility would be to use rex. If, for example IDs are numeric:

| rex field=_raw "(?i)AccountID=(?<accountID>\d+)"

The rex approach is better if you need to deal with the possibility of multiple matches in one event.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...