topic Re: lookup field value case sensitivity in Splunk Search

lookup field value case sensitivity

constantinetamp — Wed, 29 Apr 2020 14:59:23 GMT

While field values are not case sensitive by default on Splunk, when we use lookups the default setting for the field values is to be case sensitive.

I can't think of any valid use case of that inconsistency, is there any reason that I could possibly be missing?

note: I am aware that you can overwritte the case sensitivity setting when importing a lookup, I am merely wondering why doen't the default option for lookup field values align with the overall Splunk logic of field values being non case sensitive.

Re: lookup field value case sensitivity

to4kawa — Wed, 29 Apr 2020 23:24:40 GMT

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup

Syntax:

lookup [local=<bool>] [update=<bool>] <lookup-table-name> ( <lookup-field> [AS <event-field>] )... [ OUTPUT | OUTPUTNEW (<lookup-destfield> [AS <event-destfield>] )... ]

the default setting for the field values is to be case sensitive.
What are you talking about?

Re: lookup field value case sensitivity

constantinetamp — Fri, 01 May 2020 09:42:59 GMT

well what you pasted above is exactly the same thing as I'm stating on my question.

Re: lookup field value case sensitivity

to4kawa — Fri, 01 May 2020 09:56:28 GMT

lookup arguments are fieldname , not fieldvalue

https://docs.splunk.com/Splexicon:Field

and lookup is not search

https://answers.splunk.com/answers/658367/splunk-eval-case-statement-compare-the-case-sensit.html

Re: lookup field value case sensitivity

constantinetamp — Fri, 01 May 2020 12:19:03 GMT

I'm talking about the field values in lookups being case sensitive, the terms fieldname and fieldvalue in the lookup command that you're referring to are irrelevant to my question

Re: lookup field value case sensitivity

to4kawa — Fri, 01 May 2020 13:49:47 GMT

While field values are not case sensitive by default on Splunk
this is wrong assumption.

Re: lookup field value case sensitivity

constantinetamp — Fri, 01 May 2020 15:03:36 GMT

It clearly isn't an assumption that field values are case insentivite and that field names are case sensitive on Splunk, that's clearly stated on the official Splunk documentation, and it's definitely not a wrong one:

https://answers.splunk.com/answers/65/are-field-values-case-sensitive.html