topic Re: Splunk Case-Sensitive Search in Splunk Search

Splunk Case-Sensitive Search

alexspunkshell — Thu, 29 Apr 2021 10:42:16 GMT

Hi,

Can someone help me with the regex command for below?

| search ="UPN=*T@mail.cloud"

Thanks in advance!

Re: Splunk Case-Sensitive Search

aasabatini — Thu, 29 Apr 2021 11:02:32 GMT

Hi @alexspunkshell

Can you specify little bit better your request?

you write this:

| search ="UPN=*T@mail.cloud"

but the search comand don't need the "=" symbol

correct example:

| search UPN="*T@mail.cloud"

Ale

Re: Splunk Case-Sensitive Search

alexspunkshell — Thu, 29 Apr 2021 14:37:03 GMT

@aasabatini Thanks for your reply.

Yes I need regex for

| search UPN=*T@mail.cloud

If I apply this in my query then, I am also getting results for UPN= t*@mail.cloud also getting due to case sensitivity.

Please help me with regex for

| search UPN=*T@mail.cloud

Re: Splunk Case-Sensitive Search

s2_splunk — Thu, 29 Apr 2021 19:50:49 GMT

To validate your ask: You are currently getting both email addresses that end in lowercase and uppercase 'T', because of the default case-insensitivity of search. You need help figuring out how to only return email addresses that have an uppercase 'T' before the '@mail.cloud'.

Is that what you are really asking?

If so, use the CASE function to interpret your search term exactly as typed:

| search UPN=CASE(*T@mail.cloud)