topic Re: How to exclusively search for lower-case characters in Splunk Search

How to exclusively search for lower-case characters

david1395 — Thu, 12 Dec 2019 22:26:28 GMT

My query is for searching users...i.e david OR tom OR cindy...

The results are:

David
david
Tom
tom
Cindy
cindy

What do I have to change in my search to get just the small names...because the others are wrong usernames,

Re: How to exclusively search for lower-case characters

aberkow — Thu, 12 Dec 2019 22:57:16 GMT

| makeresults count=2
| streamstats count
| eval names=case(count=1, "David", count=2, "david")
| where like(names,"%david%")

Using the where command with a regex match is one option, alternatively you can just lower all the names previously in your search:

| makeresults count=2
| streamstats count
| eval names=case(count=1, "David", count=2, "david")
| eval names=lower(names)

Hope this helps!

Re: How to exclusively search for lower-case characters

vnravikumar — Fri, 13 Dec 2019 06:37:33 GMT

Check this

| makeresults 
| eval name="David,david,Tom,tom,Cindy,cindy" 
| makemv delim="," name 
| mvexpand name 
| regex name="^[a-z]+$"

Re: How to exclusively search for lower-case characters

DavidHourani — Fri, 13 Dec 2019 09:03:04 GMT

Hi @david1395,

You should change the way that field is extracted to avoid having to filter out to names in capital.

Look at the extraction of the field and instead of match any character in the name use something like ([a-z])+ to match lowercase letter only. After that your field will only contain all the valid lowercase letters.

Let me know how that works out for you.

Cheers,
another David

Re: How to exclusively search for lower-case characters

woodcock — Fri, 13 Dec 2019 10:33:22 GMT

Like this:

index="YouShouldALwaysSpecifyAnIndexEvenIfJust*" AND sourcetype="AndSourcetypeToo" AND (CASE(david) OR CASE(tom) OR CASE(cindy)) ...

Re: How to exclusively search for lower-case characters

koshyk — Fri, 13 Dec 2019 10:54:32 GMT

using CASE() is the most efficient way as it filters at _raw event itself

Re: How to exclusively search for lower-case characters

woodcock — Fri, 13 Dec 2019 11:35:10 GMT

Definitely.

Re: How to exclusively search for lower-case characters

DavidHourani — Fri, 13 Dec 2019 11:42:03 GMT

Totally.

But if he has a million users then he's not going to CASE CASE CASE, he's better off just extracting the lowercase stuff in a field and using that or using a regex as a filter

Re: How to exclusively search for lower-case characters

woodcock — Fri, 13 Dec 2019 11:44:45 GMT

It might be in a lookup and then he can use a subsearch with format to insert CASE( and ).

Re: How to exclusively search for lower-case characters

DavidHourani — Fri, 13 Dec 2019 11:46:18 GMT

True true.

Re: How to exclusively search for lower-case characters

to4kawa — Fri, 13 Dec 2019 11:48:12 GMT

index=your_index  your_field IN (CASE("david"), CASE("tom"), CASE("cindy"))

There are many.