topic Are function names case-sensitive? in Splunk Search

Are function names case-sensitive?

pm771 — Tue, 26 Sep 2017 15:49:21 GMT

The following query did not return any results:

... | stats count(EVAL(error_code=2000)) ...

I had to use lower-case eval to make it work.

Is it a general rule or a specific case?

Re: Are function names case-sensitive?

Sukisen1981 — Tue, 26 Sep 2017 18:33:05 GMT

hmm this is a fantastic question - I tried with my own test data , and you are right.
HOWEVER, i could not find any splunk documentation that explicitly points this out.
Maybe @lfedak_splunk can shed some more light on this?

Re: Are function names case-sensitive?

lfedak_splunk — Tue, 26 Sep 2017 18:40:28 GMT

Hey @pm771 and @sukisen1981, check out the answers and comments on this post: https://answers.splunk.com/answers/46/are-search-language-keywords-case-sensitive.html for some more info.
The free Splunk Fundamentals 1 course also runs through the basics of what is case-sensitive and case-insensitive if you'd like to drill that in. Based on these comments it looks like anything related to stats has to be lowercase at all times.

Re: Are function names case-sensitive?

Sukisen1981 — Tue, 29 Sep 2020 15:57:38 GMT

@lfedak_splunk - thanks for the link. Just to add a bit more. if I do something like
| eval x= .... vs EVAL X=....
results are same
BUT
if I combine it with stats then the upper case EVAL does not work.
So, I guess what @lfedak_splunk says, 'Based on these comments it looks like anything related to stats has to be lowercase at all times.' is the correct answer

Re: Are function names case-sensitive?

pm771 — Wed, 27 Sep 2017 13:10:00 GMT

@lfedak_splunk:

Is it just stats or timechart as well?

Re: Are function names case-sensitive?

DalJeanis — Wed, 27 Sep 2017 15:04:58 GMT

@pm771 - all those other verbs are effectively just skins for stats - chart, timechart, eventstats and so on. But, regardless, it's best to stick to lower case for verbs and functions, and upper case for Boolean operators. Home grown functions and macros, use the case you wrote them in.