Field names from same DB Inputs on different indexers have different cases...

[dlovett]

I have two indexers: one legacy where DB Connect 1.0.x was installed and updated as releases come out and another that is brand new with DB Connect 1.1.1 as the initial instal. The field names on the legacy indexer are all caps where the field names on new indexer are all lowercase.

Both use DB Inputs with same settings and SQL except for the name of the index;

There are no props or transforms used;

I couldn't find any difference in configurations on both indexers that are obvious; ie they're pretty simple setups;

Anybody else experiencing something like this with DB Connect DB inputs?

[mchang_splunk]

This issue has been resolved in 1.1.2:
Table column names were unexpectedly converted to lower case. (DBX-347)
Please refer to this link:
http://docs.splunk.com/Documentation/DBX/1.1.2/DeployDBX/Releasenotes#Fixed_problems

[jbrodsky_splunk]

There is an internal case on this, and it is a known issue. If you are a splunk customer under support, please open a case and reference JIRA DBX-340 so that we may track the fix and let you know when we have resolved it.

[aelliott]

Yeah and it's new to DB Connect 1.1.1 I would think they would want to fix this sometime soon or update their documentation.

[dlovett]

I always assumed the field names matched the column names in the DB. ie All of the column names in our Oracle tables are uppercase and the field names on the legacy indexer all show the field names in uppercase.

This is quite the scenario :^)

[aelliott]

Yep http://answers.splunk.com/answers/109879/case-sensitive-columns-from-sql

One workaround would be to change all your fields to lower case, but I'm not sure these should be case sensitive to begin with (or should at least match the case of the fields returned)