tstats and inputlookup case sensitive problem

[splunkreal]

We had problem this week with logs indexed with lower or upper case hostnames. We run this query in a scheduled macro :

It seems that our eval functions don't do the job.

Query attached.

Thanks.

link text

[splunkreal · Accepted solution]

Solved by adding after tstats :

| eval host = lower(host) | stats max(latest) as latest,min(earliest) as earliest by host source

[splunkreal]

The problem is with tstats which is case sensitive, I haven't problem with stats but it's very slow.

[somesoni2]

Assuming your lookup table has host names in lower case, but indexed data has various case, try this

| tstats latest(_time) as latest,earliest(_time) as earliest WHERE index = * by host source | eval host=lower(host) | search [| inputlookup liste_serv |  eval host = host+"*"  | eval source=split(logsSystem, "#") | mvexpand source | table host source] | eval host = lower(replace(host,".production.com","")) | eval timeNow=relative_time( now(), "-8h@h") | where latest<timeNow | eval last=strftime(latest, "%Y-%m-%d %T") | eval first=strftime(earliest, "%Y-%m-%d %T") | sort - last | stats list(source) as source list(last) as "lastApparition" list(latest) as latest list(count) as count by host

[splunkreal]

Thanks somesoni2 however we already tried it by adding | eval host=lower(host) before inputlookup 😞