How can I count by case-insensitive variable
Hi,
I have a search:
_sourceHost=*prd-web* AND _sourceCategory="OS_Webserver" | parse "/*.svc" as services | count by services | sort by _count
and I get the result like:
11 Services/Client 3,223
12 services/client 3,164
how can I merge these two results? ignore the case-sensitive result?
-
Sumo Logic does not currently have an operator to convert the case of a string ex. toLower(<string>) so we need to do this with an "if" operation. For Example: if(services="Services/Client", "services/client", services) as services
So the following query should get you the combined count you're after.
_sourceHost=*prd-web* AND _sourceCategory="OS_Webserver"
| parse "/*.svc" as services
| if(services="Services/Client", "services/client", services) as services
| count by services
| sort by _count
-
For anyone stumbling upon this thread, there are toLowerCase and toUpperCase functions now.
See: https://help.sumologic.com/Search/Search_Query_Language/Search_Operators/toLowerCase_and_toUpperCase
Please sign in to leave a comment.
Comments
6 comments