topic Re: Search query with like() func ignoring case in Splunk Search

Search query with like() func ignoring case

zionsof — Sun, 25 Feb 2018 08:48:01 GMT

Hey all, need some help to something I didn't manage and couldn't find any solution online.

Assuming my data is of files and is indexed as JSON form as such:

{...some stuff..., FileContent: <this-file-content> ...some stuff...}

And what I want to do is find all files that have a certain word.
So, what I currently search is:

index=main source=.... | where like(FileContent, "%someword%")

But, I want to to ignore all the case of someword (SoMeWord would be found as well).

Re: Search query with like() func ignoring case

martin_mueller — Sun, 25 Feb 2018 13:07:35 GMT

Use regular expressions if your actual matches are more complex: ... | regex FileContent="someword" or ... | where match(FileContent, "someword")
If all you want is case-sensitive search, use CASE(): http://docs.splunk.com/Documentation/Splunk/7.0.2/Search/UseCASEandTERMtomatchphrases

Re: Search query with like() func ignoring case

zionsof — Sun, 25 Feb 2018 14:01:21 GMT

Match is apparently what I needed and not like. Thanks!

Re: Search query with like() func ignoring case

ddrillic — Sun, 25 Feb 2018 20:41:29 GMT

Case sensitivity is a bit intricate with Splunk, but keep in mind that just FileContent = someword is case insensitive.

If you end up using search or where it gets interesting -

The following would work assuming someword as lower in the events -

    | search FileContent=someword  
    | search FileContent=Someword  
    | search FileContent="Someword" 
    | where  FileContent="someword"

And these won't -

    | where FileContent=someword 
    | where FileContent="Someword"

Meaning, the syntax of search is equivalent to the regular search string while where has regex syntax.

Re: Search query with like() func ignoring case

martin_mueller — Sun, 25 Feb 2018 21:58:40 GMT

That's not quite accurate, where only uses regex when told to, e.g. when using match(). The equals sign is just that, a case sensitive equals sign. field=".*" won't be true unless field literally contains a dot and an asterisk.

Re: Search query with like() func ignoring case

ddrillic — Sun, 25 Feb 2018 22:01:40 GMT

Thank you @martin_mueller!