Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- case sensitive dedup?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have two hosts, one named lower case 'server01', the other named upper case 'SERVER01'. When I do a search such as "foo | dedup host", I only get either server01 or SERVER01, and never both, because apparently dedup is performing case insensitive comparisons. Is there a way to enable case sensitivity?
Thanks much in Advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Generally (from a networking perspective) you shouldn't have two hosts with the same hostname. However, since you do, you could use regex to determine if the hostname is upper or lowercase. For example:
... | rex field=host "(?P<upperHost>[A-Z0-9]+)"| eval hostCase=if(isnotnull(upperHost), "Upper", "Lower")
Then you could run the dedup command against both the host name and the value of hostCase:
... | dedup host, hostCase
That should leave both hostnames in the results.
PS: I havn't been able to test this so the isnotnull() may not work. Instead you may want to use upperHost="".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
dedup really needs to have an in-case sensitivity option
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Generally (from a networking perspective) you shouldn't have two hosts with the same hostname. However, since you do, you could use regex to determine if the hostname is upper or lowercase. For example:
... | rex field=host "(?P<upperHost>[A-Z0-9]+)"| eval hostCase=if(isnotnull(upperHost), "Upper", "Lower")
Then you could run the dedup command against both the host name and the value of hostCase:
... | dedup host, hostCase
That should leave both hostnames in the results.
PS: I havn't been able to test this so the isnotnull() may not work. Instead you may want to use upperHost="".
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Splunk Enterprise Security: An Automated Phishing Response Workflow
Sharper ES Detections, Agentic AI Integrations, Smarter Workload Management, and More ...
Data Outage Monitoring and Reporting
