Hi,
Is it possible to perform a case insensitive join? The log files I'm working with have a field that contains values which begin with a prefix. The case of the prefix does not appear to be consistent but the rest of the string value is. Any help will be appreciated. Thank you.
Sam
You could change the case for the relevant fields before performing the join, using eval
's lower()
function. Something like:
... | eval myfield=lower(myfield) | join myfield [... | eval myfield=lower(myfield)]
You could change the case for the relevant fields before performing the join, using eval
's lower()
function. Something like:
... | eval myfield=lower(myfield) | join myfield [... | eval myfield=lower(myfield)]
Thank you. Worked like a charm.