But if he has a million users then he's not going to CASE CASE CASE, he's better off just extracting the lowercase stuff in a field and using that or using a regex as a filter
You should change the way that field is extracted to avoid having to filter out to names in capital.
Look at the extraction of the field and instead of match any character in the name use something like
([a-z])+ to match lowercase letter only. After that your field will only contain all the valid lowercase letters.
Let me know how that works out for you.
| makeresults count=2 | streamstats count | eval names=case(count=1, "David", count=2, "david") | where like(names,"%david%")
Using the where command with a regex match is one option, alternatively you can just lower all the names previously in your search:
| makeresults count=2 | streamstats count | eval names=case(count=1, "David", count=2, "david") | eval names=lower(names)
Hope this helps!