Splunk Search

Dedup case insensitive?

gascoynt
Engager

When searching in our list of usernames that have logged in, I dedup the usernames but the results are case sensitive.
For example I have user01 and User01 both showing in the search results.

How do I make the dedup case insensitive so that it will only show one of these results?

0 Karma
1 Solution

FrankVl
Ultra Champion

As far as I can see in the search reference for the dedup command, it has no way to make it case insensitive, so the only solution I see is before doing a dedup on username, change it to lowercase:

| eval username=lower(username)

View solution in original post

FrankVl
Ultra Champion

As far as I can see in the search reference for the dedup command, it has no way to make it case insensitive, so the only solution I see is before doing a dedup on username, change it to lowercase:

| eval username=lower(username)
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...