I have two hosts, one named lower case 'server01', the other named upper case 'SERVER01'. When I do a search such as "foo | dedup host", I only get either server01 or SERVER01, and never both, because apparently dedup is performing case insensitive comparisons. Is there a way to enable case sensitivity?
Thanks much in Advance.
dedup IS case-sensitive. You can convince yourself but running this search:
| stats count | eval foo="bar" | append [stats count | eval foo="BAR"] | table foo | dedup foo