How do you combine two or more values from search results into one?

[igordon]

I need to produce a report that shows average use of an app over a certain period of time. I noticed in the log the app name is not consistent. For example the same app will show up with several variations but it is the same app. So it might look like

Field 1
app=AAA
app=AaA
app=aaa

Here's what I have so far:

index=system action=successful application=app | stats count by date_month | stats avg(count) as avg_count | eval avg_count=round(avg_count) | fieldformat avg_count=tostring(avg_count,"commas")

I want the search to count all the variations of the app name but only use one value. So the desired output would be:

application avg_count
AAA 10

[cmerriman]

you might want to create a lookup table with all variations of the app name, or a macro to rename them to be the same. i run into a similar thing with apps, mainly when they move to production and all of a sudden have a new name, but i'd like them to be combined as the same name. i have created a macro with renames.
Settings>Advanced Search>Add new Search macros

what i have is called RenameApps and the definition is an eval like so: |eval appname=case(app="app1" OR app="App1","app",app="App2","app2"....)

[gcusello]

Hi,
Insert
| eval app=upper(app)
In Your search after the first search and before the first stata.
Bye.
Giuseppe

[horsefez]

Hi igordon,

you could do a

| eval app=upper(app)
or
| eval app=lower(app)

which is a sneaky trick.