topic Re: CASE() search option produces no results in Splunk Search

CASE() search option produces no results

sloshburch — Wed, 26 Feb 2014 16:33:16 GMT

While using the CASE() feature of the search command (as per http://docs.splunk.com/Documentation/Splunk/6.0.2/Search/Usethesearchcommand#Use_CASE.28.29_and_TERM.28.29_to_match_phrases) I'm seeing no events produced but there should be.

Example:

earliest=@h-15min latest=@h index=index1 OR index=index2 _raw="*Exception*"

produces results.

earliest=@h-15min latest=@h index=index1 OR index=index2 CASE(Exception)

produces NO results.

This seems to ONLY happen while using the string "Exception". Other strings within the CASE() function are working as expected.

This is on Splunk 6.0.2.

Anyone seen this before?

Re: CASE() search option produces no results

lukejadamec — Wed, 26 Feb 2014 17:36:30 GMT

Is Exception surrounded by major breakers?

Re: CASE() search option produces no results

somesoni2 — Wed, 26 Feb 2014 17:49:22 GMT

In my understanding, CASE does case-sensitive match for the a term/field values, which means it does a match for a complete word. So CASE(Exception) will match 'Exception' or 'Test.Exception.foo' but not 'OracleException' . _raw="Exception" will match a portion of a term as well hence you're getting results there. Check if Exception is a complete word/term in your logs.

Re: CASE() search option produces no results

sloshburch — Wed, 26 Feb 2014 17:49:37 GMT

It's found preceded by letters org.something.somethingelse.somethingother.TypeOfException ending with a space or a :

Re: CASE() search option produces no results

lukejadamec — Wed, 26 Feb 2014 17:50:56 GMT

That is not going to work with case. Read the bottom of the link you posted to see why. Or - what somesoni2 said.

Re: CASE() search option produces no results

lukejadamec — Wed, 26 Feb 2014 17:51:58 GMT

You might try TypeOfException

Re: CASE() search option produces no results

somesoni2 — Wed, 26 Feb 2014 17:54:24 GMT

Or use CASE(*Exception*). this will work same as _raw="*Exception*", just it will be case-sensitive.

Re: CASE() search option produces no results

sloshburch — Wed, 26 Feb 2014 22:31:30 GMT

Thank you somesoni2 - I didn't realize it had that complete-word restriction. I also thought I had previously tried wildcards with no luck. I now see wildcards work.

Thanks everyone!

Re: CASE() search option produces no results

sloshburch — Wed, 26 Feb 2014 22:31:58 GMT

See somesoni2's comment for the answer to this question.