topic Re: How to make a search case-sensitive? in Splunk Search

How to make a search case-sensitive?

muebel — Wed, 28 Jul 2010 21:05:51 GMT

How can I make a search case-sensitive? That is to say, I search for the general term "FOO" and want to only match "FOO" in results, and not "foo"

Re: How to make a search case-sensitive?

ftk — Wed, 28 Jul 2010 21:15:42 GMT

Hmm, I don't think you can turn case sensitivity on in the general search, but you should be able to hack it with rex:

foo | rex "(?<uppercase>FOO)" | search uppercase=*

Re: How to make a search case-sensitive?

bwooden — Wed, 28 Jul 2010 21:52:34 GMT

If the field is extracted: http://answers.splunk.com/questions/3485/can-i-make-field-values-case-sensitive

That thread also contains another technique if the field is not extracted.

Re: How to make a search case-sensitive?

cyue_splunk — Fri, 28 Dec 2012 02:19:37 GMT

CASE(foo) will only return events with "foo", but not "FOO" or "Foo".

Re: How to make a search case-sensitive?

Nikita_Danilov — Wed, 02 Jul 2014 12:08:03 GMT

What Splunk's version are you using? Try it:

| where field="FOO"

Re: How to make a search case-sensitive?

jburman123 — Tue, 29 Jul 2014 18:05:30 GMT

I want to perform a simple substring match that is case sensitive; for example find all occurrences of Test in a text file and ignore strings like test or test*. If you try CASE(Test) it fails? Any suggestions?

Re: How to make a search case-sensitive?

jburman123 — Thu, 31 Jul 2014 18:12:59 GMT

I am using SPLUNK Enterprise 6.1, your suggestion of using | where field="FOO" fails

Re: How to make a search case-sensitive?

northben — Thu, 19 May 2016 18:32:04 GMT

and in a strange irony, the CASE command is case-sensitive