+ fields command + question/observation on case sensititvity

[HattrickNZ]

... | fields + _time *GOUa*
this will give me my _time column on the left with other columns on the right matching the wild card critereia *GOUa* e.g. I would have columns with 0-16-GOUa as their name.

| fields + _time *gOUa*
this will give me my _time column on the left with not other other columns on the right matching the wild card critereia *gOUa* so it must be case sensitive.

Is there anyway I can make it not case sensitive?
I have a chart that I want to allow the user to filter by a text input, but I don't want it to be case sensitive. Is there a way I can control this?

As I write this, it is probably a good thing this case sensitivity. tks

[woodcock]

You cannot but you can force the fields (or copies of them) to upper or lower like this:

| makeresults 
| eval mydata="dog,green cat,green cat,orange duck,yellow donkey,green dog,green dog,green dog,blue dog,yellow dog,grey wolf,black parakeet,yellow cat,yellow cat,green dog,green donkey,green" 
| makemv mydata 
| mvexpand mydata 
| makemv delim="," mydata 
| eval gOUA-1=mvindex(mydata,0), gOUa-2=mvindex(mydata,1) 
| table gOUA-1 gOUa-2

| rename COMMENT AS "Everything above spoofs sample events; everything below is your solution"

| foreach * [eval lower_<<FIELD>>=lower("<<FIELD>>")]
| foreach lower_* [eval {<<FIELD>>} = $<<MATCHSTR>>$]
| fields - lower*

Here is another alternate solution that renames the fields:

| transpose
| eval column = lower(column)
| transpose
| rename "row *" AS row* | rename column AS "row0"
| eventstats first(row*) AS JuNkT3Mp_colName*
| foreach JuNkT3Mp_colName* [eval {<<FIELD>>} = row<<MATCHSTR>>]
| where row0 != JuNkT3Mp_colName0
| foreach JuNkT3Mp_colName* row* [fields - "<<FIELD>>"]

[jkat54]

All field names are case sensitive in Splunk. Aside from renaming them to lowercase there isn't any way around this. You could use the rex or extract commands to extract lowercase filed names on-the-fly too, but that's probably not going to help you much in this case because your fields are probably coming from KvPs in the data itself...

Best solution I have to offer is putting an HTML panel or short instructioms near the drop down that says "this is case sensitive".

If you're using fields + though I can't see many scenarios where this would even be necessary. Seems more akin to a fields - type excercise...

[jkat54]

we could probably write our own fields command that is insensitive... I'm only on the job two weeks this month though so I doubt I'll be able to roll this out anytime soon.

Maybe someone else will want to take a stab at it...