Splunk Search

What should be added to my search to convert all the results to be lower case?

pavanae
Builder

I have a Splunk query as follows

| inputlookup hosts.csv | rename Hostname as my_hostname |rex mode=sed field=my_hostname "s/..*//g

Now what should be added to my query to convert all the results to be lower case.

Tags (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi pavanae,

can you please try it?

| foreach "*" [eval <<FIELD>>=lower('<<FIELD>>') ]

Thanks

dflodstrom
Builder

This definitely works even if you just use lower(<<FIELD>>)

You could be silly and make everything lowercase too: | eval _raw=lower(_raw)

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi dflodstrom ,

Yes lower(<<FIELD>>) works but I don't think so | eval _raw=lower(_raw) will work on those fields which are extracting search time. All search time extraction will be done when search before the first Pipe (|) will execute. Even we change _raw after the first Pipe(|) the extracted fields will be the same.

For an example. Please check output of below search:

index=_internal   component=HTTPAuthManager | eval _raw=lower(_raw)  | stats  count by component, log_level,message

Thanks

gcusello
SplunkTrust
SplunkTrust

Hi pavanae,
if I correctly understood:

| inputlookup hosts.csv 
| eval my_hostname=upper(Hostname) 
| rex mode=sed field=my_hostname "s/..*//g"

Bye.
Giuseppe

0 Karma

cmerriman
Super Champion

dflodstrom
Builder

This is the easiest way to solve your specific issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...