What should be added to my search to convert all the results to be lower case?

[pavanae]

I have a Splunk query as follows

| inputlookup hosts.csv | rename Hostname as my_hostname |rex mode=sed field=my_hostname "s/..*//g

Now what should be added to my query to convert all the results to be lower case.

[kamlesh_vaghela]

Hi pavanae,

can you please try it?

| foreach "*" [eval <<FIELD>>=lower('<<FIELD>>') ]

Thanks

[dflodstrom]

This definitely works even if you just use lower(<<FIELD>>)

You could be silly and make everything lowercase too: | eval _raw=lower(_raw)

[kamlesh_vaghela]

Hi dflodstrom ,

Yes lower(<<FIELD>>) works but I don't think so | eval _raw=lower(_raw) will work on those fields which are extracting search time. All search time extraction will be done when search before the first Pipe (|) will execute. Even we change _raw after the first Pipe(|) the extracted fields will be the same.

For an example. Please check output of below search:

index=_internal   component=HTTPAuthManager | eval _raw=lower(_raw)  | stats  count by component, log_level,message

Thanks

[gcusello]

Hi pavanae,
if I correctly understood:

| inputlookup hosts.csv 
| eval my_hostname=upper(Hostname) 
| rex mode=sed field=my_hostname "s/..*//g"

Bye.
Giuseppe

[cmerriman · Accepted solution]

|eval my_hostname=lower(my_hostname)

http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/TextFunctions

[dflodstrom]

This is the easiest way to solve your specific issue.