Case sensitivity of name, in name=value pairs

[NK_1]

I would like to do a "stats distinct_count(accountID)"

However, some code modules log "accountID=xxxx", while others log "AccountID=xxxx"

Is there a way to get a distinct count of Account IDs without having to change the code that does the logging?

[southeringtonp · Accepted solution]

As long as only one or the other is present, use coalesce:

| eval accountID=coalesce(accountID, AccountID)
| stats dc(accountID)

Another possibility would be to use rex. If, for example IDs are numeric:

| rex field=_raw "(?i)AccountID=(?<accountID>\d+)"

The rex approach is better if you need to deal with the possibility of multiple matches in one event.