https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9113#M16 <P>In 6.0.1, the time modifiers (e.g. earliest, latest) must be lowercase. This may be a bug, the search job inspection shows mixed interpretation, but the base lispy output treats the date values as search terms.</P> <P>E.g.:</P> <PRE><CODE>Search: Latest="01/25/2014:00:00:00" DEBUG: base lispy: [ AND 00 01 2014 25 ... keywords latest::01/25/2014:00:00:00 </CODE></PRE> Fri, 31 Jan 2014 18:55:10 GMT bstrand0 2014-01-31T18:55:10Z https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9106#M9 <P>Are all these OK?</P> <PRE><CODE>* | STATS COUNT * | stats count * | STATS count * | stats COUNT </CODE></PRE> <P>Conclusion: search lang keywords (what I meant) break down as so:</P> <UL> <LI>Must be uppercase: <CODE>OR, NOT</CODE></LI> <LI>Must be lowercase: <CODE>avg, sum, count, earliest, ...</CODE></LI> <LI>Can be either: the rest</LI> </UL> <P>Simplest rule seems to be "uppercase <CODE>OR</CODE> and <CODE>NOT</CODE>, lowercase everything else to be safe". Which is mildly irksome, as I feel uppercasing keywords (a.k.a. operators) helps distinguish them from operands -- a primitive form of syntax highlighting, if you will. (You will see lots of SQL weenies do this.)</P> Fri, 15 Jan 2010 02:37:08 GMT https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9106#M9 V_at_Splunk 2010-01-15T02:37:08Z https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9107#M10 <P>Search language is case-insensitive, except for STATS functions: count, avg, sum, ... Those have to be lowercase.</P> Fri, 15 Jan 2010 02:38:13 GMT https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9107#M10 V_at_Splunk 2010-01-15T02:38:13Z https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9108#M11 <P>Also, field names are case sensitive.</P> Fri, 15 Jan 2010 03:02:58 GMT https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9108#M11 Stephen_Sorkin 2010-01-15T03:02:58Z https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9109#M12 <P>But field names are case-sensitive:<BR /> | stats count(a)<BR /> is different from:<BR /> | stats count(A)</P> Fri, 15 Jan 2010 03:04:16 GMT https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9109#M12 gkanapathy 2010-01-15T03:04:16Z https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9110#M13 <P>OR and NOT are case sensitive</P> Fri, 15 Jan 2010 03:09:00 GMT https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9110#M13 matt 2010-01-15T03:09:00Z https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9111#M14 <P>rex and regex must be case sensitive to their pattern texts.</P> Fri, 15 Jan 2010 03:41:01 GMT https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9111#M14 jrodman 2010-01-15T03:41:01Z https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9112#M15 <P>the "replace" operator is also case-sensitive on what you replace.</P> Wed, 20 Jan 2010 03:55:07 GMT https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9112#M15 carasso 2010-01-20T03:55:07Z https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9113#M16 <P>In 6.0.1, the time modifiers (e.g. earliest, latest) must be lowercase. This may be a bug, the search job inspection shows mixed interpretation, but the base lispy output treats the date values as search terms.</P> <P>E.g.:</P> <PRE><CODE>Search: Latest="01/25/2014:00:00:00" DEBUG: base lispy: [ AND 00 01 2014 25 ... keywords latest::01/25/2014:00:00:00 </CODE></PRE> Fri, 31 Jan 2014 18:55:10 GMT https://community.splunk.com/t5/Splunk-Search/are-search-language-keywords-case-sensitive/m-p/9113#M16 bstrand0 2014-01-31T18:55:10Z