Archive

Search terms are case sensitive or case insensitive.

palisetty
Communicator

Search terms are case sensitive or case insensitive?
(components of search language)?

For me, the answer is case sensitive but Quizlet says case insensitive. To verify, I tried it on the search bar and when I type "Index", it doesn't produce any results while I type "index", I see the events on the event list.

I am sorry I am asking some questions from Quizlet as it contradicts my understanding and I am just trying to make sure I am correct.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

There is a difference between field names and field values. The former are case-SENSITIVE, the latter are case-INsensitive. You can alter the latter by using the CASE() feature. Now search terms are also case-INsensitive. These are the text strings in a foundational search that do not use an equals sign. In other words, anything not like FIeldName="field value". So your search might look like this:

index="caseINsensitive" AND sourcetype="caseINsensitive" AND FieldNameCaseSENSITIVE="FieldValueCaseINsensitive" AND search AND "terms" AND are AND also AND case AND "INsensitive" OR (CASE(thisIsCaseSENSITIVE) OR TERM(thisIsCaseINsensitive))

View solution in original post

woodcock
Esteemed Legend

There is a difference between field names and field values. The former are case-SENSITIVE, the latter are case-INsensitive. You can alter the latter by using the CASE() feature. Now search terms are also case-INsensitive. These are the text strings in a foundational search that do not use an equals sign. In other words, anything not like FIeldName="field value". So your search might look like this:

index="caseINsensitive" AND sourcetype="caseINsensitive" AND FieldNameCaseSENSITIVE="FieldValueCaseINsensitive" AND search AND "terms" AND are AND also AND case AND "INsensitive" OR (CASE(thisIsCaseSENSITIVE) OR TERM(thisIsCaseINsensitive))

View solution in original post

palisetty
Communicator

Perfect. Thank you so much for patiently clearing my issue. Happy New Year

0 Karma

palisetty
Communicator

@woodcock What are called search terms, please?

0 Karma

woodcock
Esteemed Legend

See my updated answer.

0 Karma

palisetty
Communicator

@woodcock any one example of not like fieldname=fieldvalue, please.

0 Karma

woodcock
Esteemed Legend

See my updated answer.

0 Karma

palisetty
Communicator

@woodcock @gcusello As far as I know, Search terms are something before '|'. If we take that into consideration, we have index="main", here 'index' is Field Name which is case sensitive, "main" is Field value which is not case sensitive. But we are calling search terms are not case sensitive, i am confused, kindly help.

0 Karma

vnravikumar
Champion

Hi

Field values are not case sensitive.
Field names are always case sensitive.

palisetty
Communicator

That is correct, I was thinking search terms come under everything before '|'. I forgot about Field Names and Field Values. Thank you for correcting me.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!