I'm wondering if there is a way to change my configuration files to ignore the capitalization of a field. For example, I would want myField and MyField to both show up if my search is something like:
I know there are workarounds for this (e.g. rename and evaluating into a new field), but I was wondering if there is any easier way to handle this case. Ideally, I could set this in a conf file.
There is no facility in Splunk to ignore case sensitivity in field names, since they are meant to be used as labels, like in programming where each label is unique.
You can, however set field aliases in the props.conf file in your sourcetype stanza
so it would be something like this:
EXTRACT-extractip = (?
You might also want to take a look at this :
You haven't said what you're trying to address exactly, but perhaps a combination of the two approaches would spark something for you...