We can make field value in lowercase at index-time using the below config in transforms.conf  Here is the syntax that you can use it. --> For Example: If we want to make source field to lower case then use below syntex INGEST_EVAL = source=lower(source)   Fro more info refer -https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/Data/IngestEval ... View more