topic Can I make field values case-sensitive? in Splunk Search

Can I make field values case-sensitive?

maverick — Thu, 10 Jun 2010 02:49:57 GMT

Is there a way to enforce case-sensitivity on a field by field basis?

Example:

myid="0ZP0YFS5Rl7pACDD1K002"

and

myid="0ZP0YFS5Rl7pACDD1k002"

where the lower-case k at the far right of the value makes these two field values different.

Re: Can I make field values case-sensitive?

ziegfried — Thu, 10 Jun 2010 03:16:35 GMT

You can use the where command to enforce case sensitivity:

sourcetype=whatever | where myid="0ZP0YFS5Rl7pACDD1K002"

Re: Can I make field values case-sensitive?

gkanapathy — Thu, 10 Jun 2010 18:54:47 GMT

values do not have case-sensitivity. operations on values may have sensitivity to the case of the values. there is no global way to make every possible operation and function in Splunk case-insensitive, and besides "search", most are case-sensitive. You can of course always normalize most values using the "upper()" or "lower()" eval functions, but (for example) this can't be applied to match values in lookup tables.

Re: Can I make field values case-sensitive?

Lowell — Sat, 12 Jun 2010 00:44:20 GMT

Another options is to use the regex command. In general, the where option mentioned by Siegfried seems like the best for your specific usage scenario, but regex would be more flexible when:

Trying to case-sensitively match text within the raw event (e.g. if a specific field is not already defined)
Trying to match part of a field (because wildcard expansion does not work with the where command, so you can't do | where myid="*pACDD1K002" to case-sensitively match a suffix.)

Matching part of a raw event:

sourcetype=whatever 0ZP0YFS5Rl7pACDD1K002 | regex _raw="\b0ZP0YFS5Rl7pACDD1K002\b"

A partial-field matching example:

sourcetype=whatever myid="*pACDD1K002" | regex myid=".*pACDD1K002$"

Re: Can I make field values case-sensitive?

gkanapathy — Thu, 09 Sep 2010 00:40:13 GMT

You should instead code the above as: sourcetype=whatever myid="0ZP0YFS5Rl7pACDD1K002" | where myid="0ZP0YFS5Rl7pACDD1K002". If you do not do so, the search will likely be much less efficient, as it will need to bring back everything from the sourcetype without taking advantage of the index, then filter it with where. Instead, bring back only the items that match, regardless of case. This should be a much smaller set and efficiently retrieved via the index, and you then are simply filtering out on a much smaller set.

Re: Can I make field values case-sensitive?

gkanapathy — Thu, 09 Sep 2010 00:41:45 GMT

Please ensure that you include enough of the text search string in the base query to ensure that the search is efficiently using the index, e.g., sourcetype=whatever "0ZP0YFS5Rl7pACDD1K002" | regex _raw="\b0ZP0YFS5Rl7pACDD1K002\b" should be a much faster search.