How could I combine two fields that differ in the case of letters?

Last Updated: Feb 01, 2016 03:59PM PST
Sometimes you may have few fields that exists in two forms, lower case and upper case ( for example twc and TWC). But the problem comes when you want to see them in the trendline or apply statistics, they will be treated differently due to their case.

So, in order to treat them as one, you could setup a derived field with a regex like ^(twc|TWC)$ as below:

So now, all new log entries when they will come will be parsed for this derived field and you could search for this derived field when you want to combine the results.
seconds ago
a minute ago
minutes ago
an hour ago
hours ago
a day ago
days ago
Invalid characters found