topic Re: How to make case InSensitive search everywhere by default? in Splunk Search

How to make case InSensitive search everywhere by default?

Nikita_Danilov — Wed, 02 Jul 2014 11:52:51 GMT

Hi all,

I need to make by default all searches in Splunk 6.1.1 as case InSensitive.
For example, this search are case InSensitive:

index=_internal log_level=info

But this search are case Sensitive:

index=_internal | where log_level=info

Hm, strange... Why? Maybe it's bug and I need to report about it? How can I set default case InSensitive search everywhere? I know about function lower(), but it's just particular solution.

Thanks.

Re: How to make case InSensitive search everywhere by default?

martin_mueller — Wed, 02 Jul 2014 12:20:48 GMT

That's not a bug, Splunk is case sensitive except in the search command. (Maybe there's a few more exceptions...)

In your example, you could do this:

index=_internal | ... | search log_level=info

That'll find info, Info, INFO, ...

Re: How to make case InSensitive search everywhere by default?

Nikita_Danilov — Wed, 02 Jul 2014 12:34:57 GMT

Martin, thanks, but what about count(eval(log_level=info))? I need to use everywhere lower()? Where I can find information about this "exceptions"? This case surprised me, because in other Answers people say that "Splunk is case InSensitive".

Re: How to make case InSensitive search everywhere by default?

martin_mueller — Wed, 02 Jul 2014 12:49:19 GMT

You could do this:

count(eval(match(log_level, "(?i)^info$")))

Or this for much more readability in case you have multiple long statements:

... | eval info_level = if(match(log_level, "(?i)^info$"), 1, 0) | stats sum(info_level)

The other answers you found may be referring to the search command, that indeed does treat values as case insensitive.

Re: How to make case InSensitive search everywhere by default?

Nikita_Danilov — Wed, 02 Jul 2014 12:53:01 GMT

Does match(,) have better performance than lower()?

Re: How to make case InSensitive search everywhere by default?

martin_mueller — Wed, 02 Jul 2014 12:56:45 GMT

Dunno. lower() should be pretty quick, and match() with a fast regular expression such as this one anchored to both ends without any multiplicity or options should be pretty quick as well.

Here's another option, didn't test its speed:

count(eval(searchmatch("log_level=info")))