Is it possible to force the results to be used in a report to be case insensitive? For example UDP and udp are shown as different items.
You can use the lower()
(or upper()
) function in an | eval
command to normalize field values and report accordingly.
source=x userid=* | eval userid=lower(userid) | stats count by userid
You can use the lower()
(or upper()
) function in an | eval
command to normalize field values and report accordingly.
source=x userid=* | eval userid=lower(userid) | stats count by userid