topic Search only for full match letter case in Splunk Search

Search only for full match letter case

templier — Fri, 01 Jul 2016 11:34:05 GMT

Hello all,
I have a next case.
In one of my index i have a data on Russian language, and if i want start search something i must know accurate name.
Search is case-sensitive letters.
For example if in log we have a word Сессия and in search request we write index="index_name" "сессия" - we haven't anything in result.

Maybe anybody know solution to this problem.
Thank you.

Re: Search only for full match letter case

woodcock — Fri, 01 Jul 2016 12:36:08 GMT

The base search in splunk is always case-insensitive. To make it case-sensitive, use the CASE operator like this:

index="index_name" CASE(сессия)

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search

This search should be case-insensitive:

index="index_name" сессия

If it is not matching, it is because of the extra double-quotes you used.

Re: Search only for full match letter case

templier — Tue, 29 Sep 2020 10:07:51 GMT

With information on the link is not yet time to read, but test what you write me,

index="index_name" *ессия - i have a 40 strings in result.
index="index_name" cессия - i have a 7 strings in result.
index="index_name" Cессия - i have a 33 strings in result.

If i try index="index_name" CASE(сессия) - i have 7 string in result.

And i want have all 40 string when i use something like index="index_name" cессия

Re: Search only for full match letter case

woodcock — Fri, 01 Jul 2016 13:24:18 GMT

Your problem is segmenting and the non-segmenting characters that are surrounding your string. The bottom line is that you need to use the asterisk wildcard (probably on both ends). Read more about it here:

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Segmentersconf

Re: Search only for full match letter case

templier — Mon, 04 Jul 2016 10:33:22 GMT

Ok, i understand.
Thanks!

Re: Search only for full match letter case

StillJeff — Fri, 27 Oct 2017 14:21:43 GMT

Thank you. I've been searching all morning for case related to upper and lower case letters, not the case statement.

I'm looking for a generic account named 'devops' and I get results for the directory named 'DevOps'. This weeded out the unwanted results.