I have a Splunk query as follows
| inputlookup hosts.csv | rename Hostname as my_hostname |rex mode=sed field=my_hostname "s/..*//g
Now what should be added to my query to convert all the results to be lower case.
|eval my_hostname=lower(my_hostname)
http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/TextFunctions
Hi pavanae,
can you please try it?
| foreach "*" [eval <<FIELD>>=lower('<<FIELD>>') ]
Thanks
This definitely works even if you just use lower(<<FIELD>>)
You could be silly and make everything lowercase too: | eval _raw=lower(_raw)
Hi dflodstrom ,
Yes lower(<<FIELD>>)
works but I don't think so | eval _raw=lower(_raw)
will work on those fields which are extracting search time. All search time extraction will be done when search before the first Pipe (|) will execute. Even we change _raw after the first Pipe(|) the extracted fields will be the same.
For an example. Please check output of below search:
index=_internal component=HTTPAuthManager | eval _raw=lower(_raw) | stats count by component, log_level,message
Thanks
Hi pavanae,
if I correctly understood:
| inputlookup hosts.csv
| eval my_hostname=upper(Hostname)
| rex mode=sed field=my_hostname "s/..*//g"
Bye.
Giuseppe
|eval my_hostname=lower(my_hostname)
http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/TextFunctions
This is the easiest way to solve your specific issue.