Splunk Search

makin the keyword case in-sensitive

abhayneilam
Contributor

Hi,
My report is getting generated as :

Keyword No_of_occurance
Mumbai 2
kolkata 2
DELhi 1
delhi 3

but my output should be like :

Keyword No_of_occurance
Mumbai 2
kolkata 2
delhi 4

because "delhi" and "DELhi" both are same keyword but occurance is 4

Please help me to achieve this

Thanks
Abhay

0 Karma
1 Solution

dshpritz
SplunkTrust
SplunkTrust

Hey Abhay,

You wouldn't really make it case insensitive, as much as normalize the case of the data. To do that you would do something like:

myfunsearch | eval Keyword = eval lower(Keyword) | stats count by Keyword

HTH,

Dave

View solution in original post

0 Karma

dshpritz
SplunkTrust
SplunkTrust

Hey Abhay,

You wouldn't really make it case insensitive, as much as normalize the case of the data. To do that you would do something like:

myfunsearch | eval Keyword = eval lower(Keyword) | stats count by Keyword

HTH,

Dave

0 Karma

abhayneilam
Contributor

Many Many thanks for this 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...