Merge case sensitive and not case sensitive username event windows

[a5003976]

Hello,
thanks all in advance for your response.
Can i merge events of windows, in particular field User_Name, when there are multiple occurrences with upper and lower case in username?

For example:

DOMAIN\name or DOMAIN\NAME or DOMAIN\Name or DOMAIN\namE

i want to create a search (regex or other) that have as output a single result and not multiple results.

there is chance to get it?

Thanks.
Mark.

[richgalloway · Accepted solution]

You can normalize the field before displaying or processing it. For example,

... | eval User_Name=lower(User_Name) | stats count by User_Name | table User_name count

[a5003976]

Thanks richgalloway!!