Generally (from a networking perspective) you shouldn't have two hosts with the same hostname. However, since you do, you could use regex to determine if the hostname is upper or lowercase. For example:
... | rex field=host "(?P<upperHost>[A-Z0-9]+)"| eval hostCase=if(isnotnull(upperHost), "Upper", "Lower")
Then you could run the dedup command against both the host name and the value of hostCase:
... | dedup host, hostCase
That should leave both hostnames in the results.
PS: I havn't been able to test this so the isnotnull() may not work. Instead you may want to use upperHost="".
... View more