https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11157#M688 <P>What jrodman said is correct. Currently there is no ability to do case insensitive matching directly. You can either smash case in eval before calling the lookup operator, or use a scripted lookup where obviously you can do whatever type of matching you want.</P> Fri, 09 Apr 2010 00:52:01 GMT steveyz 2010-04-09T00:52:01Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11154#M685 <P>Let's say I have a lookup table that looks like this:</P> <P>host,tmoapp somehost01,app01 somehost02,app01 anotherhost01,app02 anotherhost02,app02 ...</P> <P>The issue is when a host field comes in from the agent as (say) 'SOMEHOST02'... That hostname will not get its tmoapp field correctly populated because the hostname case is wrong/different. What I would like is a way to do the lookup similar to 'grep -i' (i.e. case insensitive). Is this possible? </P> Thu, 08 Apr 2010 22:17:35 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11154#M685 Jaci 2010-04-08T22:17:35Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11155#M686 <P>I have a related outstanding question: <A href="http://answers.splunk.com/questions/718/how-are-values-in-lookups-matched">http://answers.splunk.com/questions/718/how-are-values-in-lookups-matched</A></P> Thu, 08 Apr 2010 22:49:00 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11155#M686 gkanapathy 2010-04-08T22:49:00Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11156#M687 <P>Well, if your lookup is a script, you can of course explicitly smash case. You could also explicitly smash the case in eval. ...|eval host=lower(host) | lookup ... </P> <P>However given that our text is searched in a case-insensitive fashion, it seems like supporting lookups in an insensitive fashion should be possible, but I don't know if it currently is.</P> Thu, 08 Apr 2010 23:00:09 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11156#M687 jrodman 2010-04-08T23:00:09Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11157#M688 <P>What jrodman said is correct. Currently there is no ability to do case insensitive matching directly. You can either smash case in eval before calling the lookup operator, or use a scripted lookup where obviously you can do whatever type of matching you want.</P> Fri, 09 Apr 2010 00:52:01 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11157#M688 steveyz 2010-04-09T00:52:01Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11158#M689 <P>In version 4.1.4, we provide an option to configure lookups to be case insensitive.</P> <P>Sweet.</P> Fri, 11 Jun 2010 11:59:46 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11158#M689 the_wolverine 2010-06-11T11:59:46Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11159#M690 <P>That IS sweet!!</P> Fri, 11 Jun 2010 19:24:53 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11159#M690 jeff 2010-06-11T19:24:53Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11160#M691 <P>Transforms.conf, underneath the stanza defining your lookup, case_sensitive_match = false</P> Mon, 28 Sep 2020 09:17:46 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-make-lookup-NOT-case-sensitive/m-p/11160#M691 Jason 2020-09-28T09:17:46Z