Splunk Search

Dedup case insensitive?

gascoynt
Engager

When searching in our list of usernames that have logged in, I dedup the usernames but the results are case sensitive.
For example I have user01 and User01 both showing in the search results.

How do I make the dedup case insensitive so that it will only show one of these results?

0 Karma
1 Solution

FrankVl
Ultra Champion

As far as I can see in the search reference for the dedup command, it has no way to make it case insensitive, so the only solution I see is before doing a dedup on username, change it to lowercase:

| eval username=lower(username)

View solution in original post

FrankVl
Ultra Champion

As far as I can see in the search reference for the dedup command, it has no way to make it case insensitive, so the only solution I see is before doing a dedup on username, change it to lowercase:

| eval username=lower(username)
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...