Combining Rows from Case-Insensitive search with multiple results?

[mcrawford44]

When searching an index for "foo", multiple results are returned as so;

Ex. index=blah machine_domain=foo | stats count by machine_domain

foo     1
Foo     2
FOO     3

How would one combine the rows and counts?

[somesoni2 · Accepted solution]

You can decide on which case to display the machine_domain (I have used upper) and then use below command.

index=blah machine_domain=foo | eval machine_domain=upper(machine_domain)| stats count by machine_domain 

[somesoni2]

Yes...the answer I provided is showing all the data/count, its the just how/which case the machine_name will be displayed, you have to decide. Your can upper or lower (in eval command) for the same. So if you want final output as "foo....6", use "|eval machine_domain=lower(machine_name)".

[mcrawford44]

That worked, and combined the counts. Could you possibly elaborate on how this works to combine the results? It reads like all it's going to do is capitalize the initial search.