I would like to do a "stats distinct_count(accountID)"
However, some code modules log "accountID=xxxx", while others log "AccountID=xxxx"
Is there a way to get a distinct count of Account IDs without having to change the code that does the logging?
As long as only one or the other is present, use coalesce:
| eval accountID=coalesce(accountID, AccountID)
| stats dc(accountID)
Another possibility would be to use rex. If, for example IDs are numeric:
| rex field=_raw "(?i)AccountID=(?<accountID>\d+)"
The rex approach is better if you need to deal with the possibility of multiple matches in one event.
View solution in original post