Extracted Field to be case insensitive

[harshjets]

Hi,
I have a
Event 1 : 2013-04-02 04:22:38 199.xx.x.211 OPTIONS /CockpitNew - 4444 domain1\123456 102.220.13.119 ebDAV-MiniRedir/6.1.7600 200 0 64 143
Event 2 : 2013-04-02 05:22:38 199.xx.x.211 OPTIONS /CockpitNew - 4444 DOMAIN1\123456 102.220.13.119 ebDAV-MiniRedir/6.1.7600 200 0 64 143
When I extract the Domain field: domain1 & DOMAIN1 come up separately.
I want both of them to be under the DOMAIN1 value.
How can I do it. The regular regex during field extraction doesn't let me.

Thanks

[martin_mueller]

Regular expressions cannot do this. You can however define a calculated field that converts each value to upper case.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/definecalcfields

[andreac81]

I have the same problem, I have many fields extracted with regular expression that sometimes are uppercase, other times are lowercase.
I need to define a calculated field for each filed or is some way to define only one calculated field that converts all fields in uppercase?

[somesoni2]

You would need to create separate calculated field for each field whose value you want to change to upper case.

[alemarzu]

Try this andreac, working example just copy & paste code.

| makeresults 
| eval temp="2013-04-02 04:22:38 199.xx.x.211 OPTIONS /CockpitNew - 4444 domain1\123456 102.220.13.119 ebDAV-MiniRedir/6.1.7600 200 0 64 143"."#"."2013-04-02 05:22:38 199.xx.x.211 OPTIONS /CockpitNew - 4444 DOMAIN1\123456 102.220.13.119 ebDAV-MiniRedir/6.1.7600 200 0 64 143"
| makemv delim="#" temp
| mvexpand temp
| rex field=temp max_match=0 "(?)-\s[\d]+\s(?<IMINSENSITIVE>[^\s]+)\s[\d\.]+\s"
| eval IMINSENSITIVE=lower(IMINSENSITIVE)

Hope it helps.