not sure how this happened, but I have the same host listed twice; once in all lower case (host1) and once in all CAPS (HOST1). I want to filter out the lowercase one (not many entries for it and has stopped collecting logs). If I tag the lower case one (host1::bogus) would it also tag the upper case one as well? Or, could I filter it out by doing a search for all lowercase (not sure how to do that)?
Check out CASE()
and TERM()
to do case sensitive matches. You could set these in a tag
or eventtype
to accomplish this.
Check out CASE()
and TERM()
to do case sensitive matches. You could set these in a tag
or eventtype
to accomplish this.