topic Re: Compare case-sensitivity of fields in Splunk Search

Compare case-sensitivity of fields

tb5821 — Tue, 24 Mar 2020 21:02:13 GMT

I'm using a rex to extract a field called field1 from my search... how do I take all the results of field1 and call out if they match on case or not? ie

_time   abc_123  
_time   ABC_123

_time   def_123
_time   def_123

first example I'd want to say there's a case diff while the second example is fine since the case's match

Re: Compare case-sensitivity of fields

to4kawa — Tue, 24 Mar 2020 21:45:55 GMT

try (?i) option

https://www.pcre.org/original/doc/html/pcrepattern.html#SEC13

Re: Compare case-sensitivity of fields

tb5821 — Tue, 24 Mar 2020 22:24:56 GMT

sorry not the regex - I already got the field reguardless of case but now I need to compare them ....

Re: Compare case-sensitivity of fields

woodcock — Tue, 24 Mar 2020 23:56:52 GMT

The easiest thing is to do this:

... | eval field1lower=lower(field1)
| stats values(field1) values(field1lower) dc(field1) dc(field1lower)

You can also use the ignore-case modifier (?i) for any RegEx.