I have field values that are the same as each other but in different cases.
How can I standardize them to prevent inconsistencies in my results?
Thank you,
I'm going to assume that you have some fields that contain both "No" and "no" as potential values.
1) Before running a stats (or similar aggregation command), you should take each such field and apply either the upper or lower command to the field, such as
| eval myfield = lower(myfield)
| stats count by myfield
2) When using a rex
or regex
or match
command on the field, at the front of the regular expression, add the flag "(?i)"
to do case-insensitive matching.
| regex AnotherField="(?i)yes"
which is equivalent to
| regex AnotherField="(yes|yeS|yEs|yES|Yes|YeS|YEs|YES)"