topic Re: Can case_sensitive_match be applied globally? in Getting Data In

Can case_sensitive_match be applied globally?

cdoebert — Wed, 30 Sep 2020 00:14:23 GMT

Is there a "one-shot" way to make all current lookups case-insensitive and ensure future ones are, too?

[default]
case_sensitive_match = 0

... in a /local/transforms.conf seems like the easiest way to do that, but is case_sensitive_match a global variable? If not, is there another way to accomplish this without modifying all lookups individually now and at creation time?

Re: Can case_sensitive_match be applied globally?

somesoni2 — Wed, 30 Sep 2020 00:16:55 GMT

The case_sensitive_match attribute is NOT a global attribute. I don't see any easy way to set it up for all existing lookup definitions but if you're on Splunk 6.5 and above, you get the checkbox to enable/disable this while creating the lookup transform from Splunk Web UI.

Re: Can case_sensitive_match be applied globally?

cdoebert — Thu, 25 Apr 2019 20:23:14 GMT

That's what I was afraid of; no way to override the global default. Thank you!

Re: Can case_sensitive_match be applied globally?

skoelpin — Mon, 29 Apr 2019 12:34:43 GMT

A thought here.. You could create a macro which "normalizes" all your data. You then pass that macro in your query like this

index=.. sourcetype=..
| `normalize_macro`
| lookup ..

Re: Can case_sensitive_match be applied globally?

codebuilder — Wed, 30 Sep 2020 00:18:59 GMT

If you set case_sensitive_match = false in the [default] stanza of $SPLUNK_HOME/etc/system/local/transforms.conf then yes, it will become global.

The system local directory has the highest precedence and will override settings encountered elsewhere (app default, app local, etc).