topic Field values are case insensitive? in Splunk Search

Field values are case insensitive?

vn_g — Tue, 15 Dec 2020 06:39:04 GMT

index="win*" host="abc" -- doesnt give results

index="win*" host="ABC" -- gives results

But , it is not suppose to function that way , since I heard Field values are case insensitive? Kindly help

Re: Field values are case insensitive?

nickhills — Tue, 15 Dec 2020 10:27:31 GMT

Field values in search are not case sensitive

However some other commands like stats, sort do utilise case sensitivity.
Also by default, lookups are also case sensitive (although this is configurable)

I can not offer an explanation of why the two very simple examples above would produce different results. Are you able to provide a screenshot demonstrating this?

Are you testing with simple queries (like the example) or is this behaviour observed as part of a larger query?

Re: Field values are case insensitive?

vn_g — Tue, 15 Dec 2020 10:52:22 GMT

Yes , I am just using the basic search query index and host value .

Re: Field values are case insensitive?

nickhills — Tue, 15 Dec 2020 11:15:40 GMT

What is the format of the hostname?

I can see it's euraXXXXXXXX can you give a full example like this:

eura0-y34-abc3
AAAAN-ANN-AAAN

Where A is a letter, N is a Number and any other character is shown

Re: Field values are case insensitive?

vn_g — Tue, 15 Dec 2020 11:22:29 GMT

It is like AAAAAANNNNNA

Re: Field values are case insensitive?

vn_g — Fri, 08 Jan 2021 06:30:11 GMT

I have attached the screenshot. I am using the simple query which has only index and host name. The hostname is in the format -- AAAAAANNNNNA.