Splunk Search

makin the keyword case in-sensitive

abhayneilam
Contributor

Hi,
My report is getting generated as :

Keyword No_of_occurance
Mumbai 2
kolkata 2
DELhi 1
delhi 3

but my output should be like :

Keyword No_of_occurance
Mumbai 2
kolkata 2
delhi 4

because "delhi" and "DELhi" both are same keyword but occurance is 4

Please help me to achieve this

Thanks
Abhay

0 Karma
1 Solution

dshpritz
SplunkTrust
SplunkTrust

Hey Abhay,

You wouldn't really make it case insensitive, as much as normalize the case of the data. To do that you would do something like:

myfunsearch | eval Keyword = eval lower(Keyword) | stats count by Keyword

HTH,

Dave

View solution in original post

0 Karma

dshpritz
SplunkTrust
SplunkTrust

Hey Abhay,

You wouldn't really make it case insensitive, as much as normalize the case of the data. To do that you would do something like:

myfunsearch | eval Keyword = eval lower(Keyword) | stats count by Keyword

HTH,

Dave

0 Karma

abhayneilam
Contributor

Many Many thanks for this 🙂

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...