How can I count by case-insensitive variable



  • Avatar
    Kevin Keech

    Sumo Logic does not currently have an operator to convert the case of a string ex. toLower(<string>) so we need to do this with an "if" operation. For Example:  if(services="Services/Client", "services/client", services) as services

    So the following query should get you the combined count you're after.

    _sourceHost=*prd-web* AND _sourceCategory="OS_Webserver"

    | parse "/*.svc" as services

    | if(services="Services/Client", "services/client", services) as services

    | count by services

    | sort by _count

  • Avatar
    Rajiv Delwadia

    I really need both case-insensitive extractions (using a regex) and case-insensitive grouping.  I cannot use an "if" operator because I do not know all the possible values.

  • Avatar
    Michael Bradshaw

    +1 on this request.  You can do a format to change everything to uppercase, and then match on that.

    so right after your parse:

    | format("%S",services) as service_calls

    Then you can count by service_calls and get everything combined as you expect.

  • Avatar
    Christian Beedgen

    we are considering adding a "lowercase" and an "uppercase" function. we just wanted to get "concat" and espcecially "format" out of the way first.



  • Avatar
    Michael Bradshaw

    Awesome.  Perhaps just a case insensitive option that formats the results so you get the result of the search you'd expect using it would work as well.

  • Avatar
    Ezra Jennings

    For anyone stumbling upon this thread, there are toLowerCase and toUpperCase functions now.


Please sign in to leave a comment.