Splunk Search

Dedup case insensitive?

gascoynt
Engager

When searching in our list of usernames that have logged in, I dedup the usernames but the results are case sensitive.
For example I have user01 and User01 both showing in the search results.

How do I make the dedup case insensitive so that it will only show one of these results?

0 Karma
1 Solution

FrankVl
Ultra Champion

As far as I can see in the search reference for the dedup command, it has no way to make it case insensitive, so the only solution I see is before doing a dedup on username, change it to lowercase:

| eval username=lower(username)

View solution in original post

FrankVl
Ultra Champion

As far as I can see in the search reference for the dedup command, it has no way to make it case insensitive, so the only solution I see is before doing a dedup on username, change it to lowercase:

| eval username=lower(username)
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...