|
Let's say I have a lookup table that looks like this: host,tmoapp somehost01,app01 somehost02,app01 anotherhost01,app02 anotherhost02,app02 ... The issue is when a host field comes in from the agent as (say) 'SOMEHOST02'... That hostname will not get its tmoapp field correctly populated because the hostname case is wrong/different. What I would like is a way to do the lookup similar to 'grep -i' (i.e. case insensitive). Is this possible? |
|
Well, if your lookup is a script, you can of course explicitly smash case. You could also explicitly smash the case in eval. ...|eval host=lower(host) | lookup ... However given that our text is searched in a case-insensitive fashion, it seems like supporting lokoops in an insensitive fashion should be possible, but I don't know if it currently is. |
|
What jrodman said is correct. Currently there is no ability to do case insensitive matching directly. You can either smash case in eval before calling the lookup operator, or use a scripted lookup where obviously you can do whatever type of matching you want. |
I have a related outstanding question: http://answers.splunk.com/questions/718/how-are-values-in-lookups-matched