https://community.splunk.com/t5/Getting-Data-In/How-do-I-filter-data-with-upper-case-and-lower-case-sensitive/m-p/219268#M43069 <P>Is there a way to restrict this search with upper case and lower case scenarios?</P> <PRE><CODE>index=aap_prod sourcetype="HDP:PROD:OOZIE" (":start:] with user-retry state" OR "@end***]Action updated in DB!") </CODE></PRE> <P>When I use this <CODE>@end***</CODE>, it also returns results with <CODE>END_IMPORT***</CODE>, which is an event detail for failed jobs.</P> <P>Two different search scenarios</P> Thu, 25 Feb 2016 19:29:54 GMT athorat 2016-02-25T19:29:54Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-filter-data-with-upper-case-and-lower-case-sensitive/m-p/219268#M43069 <P>Is there a way to restrict this search with upper case and lower case scenarios?</P> <PRE><CODE>index=aap_prod sourcetype="HDP:PROD:OOZIE" (":start:] with user-retry state" OR "@end***]Action updated in DB!") </CODE></PRE> <P>When I use this <CODE>@end***</CODE>, it also returns results with <CODE>END_IMPORT***</CODE>, which is an event detail for failed jobs.</P> <P>Two different search scenarios</P> Thu, 25 Feb 2016 19:29:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-filter-data-with-upper-case-and-lower-case-sensitive/m-p/219268#M43069 athorat 2016-02-25T19:29:54Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-filter-data-with-upper-case-and-lower-case-sensitive/m-p/219269#M43070 <P>Hi , you can try something like<BR /> <CODE>index=aap_prod sourcetype="HDP:PROD:OOZIE" (":start:] with user-retry state" OR CASE(@end***]Action updated in DB))</CODE></P> Thu, 25 Feb 2016 19:58:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-filter-data-with-upper-case-and-lower-case-sensitive/m-p/219269#M43070 Yasaswy 2016-02-25T19:58:12Z