https://community.splunk.com/t5/Knowledge-Management/Case-Sensitivity-in-eventtype-searches/m-p/17970#M124 <P>You can create a field extraction that uses the case sensitivity of regexes to create a new field only if the first character is uppercase or lowercase. For example:</P> <PRE><CODE>SOURCE_KEY = LOGIN_ID REGEX = (?&lt;LOGIN_ID_UPPER&gt;[A-Z].*) </CODE></PRE> <P>Note that this relies on <CODE>LOGIN_ID</CODE> being a regex extracted field, since automatically extracted fields are processed after regex fields.</P> Thu, 30 Dec 2010 01:05:29 GMT Stephen_Sorkin 2010-12-30T01:05:29Z https://community.splunk.com/t5/Knowledge-Management/Case-Sensitivity-in-eventtype-searches/m-p/17969#M123 <P>I want to make a group/eventtype with events from a certain sourcetype where LOGINID="I*" and 'I' is capital only. There are some solutions for case sensitivity up on answers already, but they all involve piping to a function or regex. And when you go to make an eventtype Splunk does not accept search queries with pipes. What can I do to make this search case-sensitive?</P> Mon, 27 Dec 2010 13:26:34 GMT https://community.splunk.com/t5/Knowledge-Management/Case-Sensitivity-in-eventtype-searches/m-p/17969#M123 gpburgett 2010-12-27T13:26:34Z https://community.splunk.com/t5/Knowledge-Management/Case-Sensitivity-in-eventtype-searches/m-p/17970#M124 <P>You can create a field extraction that uses the case sensitivity of regexes to create a new field only if the first character is uppercase or lowercase. For example:</P> <PRE><CODE>SOURCE_KEY = LOGIN_ID REGEX = (?&lt;LOGIN_ID_UPPER&gt;[A-Z].*) </CODE></PRE> <P>Note that this relies on <CODE>LOGIN_ID</CODE> being a regex extracted field, since automatically extracted fields are processed after regex fields.</P> Thu, 30 Dec 2010 01:05:29 GMT https://community.splunk.com/t5/Knowledge-Management/Case-Sensitivity-in-eventtype-searches/m-p/17970#M124 Stephen_Sorkin 2010-12-30T01:05:29Z