host name is listed twice - lowercase and CAPS

[pil321]

not sure how this happened, but I have the same host listed twice; once in all lower case (host1) and once in all CAPS (HOST1). I want to filter out the lowercase one (not many entries for it and has stopped collecting logs). If I tag the lower case one (host1::bogus) would it also tag the upper case one as well? Or, could I filter it out by doing a search for all lowercase (not sure how to do that)?

[jtrucks · Accepted solution]

Check out CASE() and TERM() to do case sensitive matches. You could set these in a tag or eventtype to accomplish this.