Getting Data In

Are sourcetype names case-sensitive?

Justin_Grant
Contributor

Yet another case-sensitivity question: are sourcetype names case-sensitive?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

In search, no they are not. Note that this is very similar to the more general question:

http://answers.splunk.com/questions/65/are-field-values-case-sensitive

See my answer there. I go into a little more detail there which you might find interesting.

View solution in original post

anwarmian
Communicator

sourcetype in props.conf in case-senstive

[MySourcetype] is different from [mysourcetype]
From Splunk Documentation (pros.conf)

By default, [source::<source>] and [<sourcetype>] stanzas match in a
case-sensitive manner, while [host::<host>] stanzas match in a
case-insensitive manner. This is a convenient default, given that DNS names
are case-insensitive.



0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Well...in props.conf I think they will be (unless you express the stanza like: [::(?i)mYSourCeTypeName]. In thesearchcommand (which is implicit at the start of a query) they won't be, but forwherecomparisons in search queries,stats` values, etc., they will be.

It's not whether the names themselves are case-sensitive. It's whether whatever you're doing at the time is sensitive to the case of the names. It's more accurate to say that Splunk is case-sensitive in most places where you'd use a sourcetype name, and that the search command is actually an exception.

0 Karma

sideview
SplunkTrust
SplunkTrust

In search, no they are not. Note that this is very similar to the more general question:

http://answers.splunk.com/questions/65/are-field-values-case-sensitive

See my answer there. I go into a little more detail there which you might find interesting.

CerielTjuh
Path Finder

You can try this yourself 🙂

sourcetype="wineventlog:security"

instead of

sourcetype="WinEventLog:Security"

both work, so I'm assuming its not case sensitive

Zaphod
Engager

This is not my experience.

index=* sourcetype=Xmlwineventlog | stats count by sourcetype

returns stats for sourcetype XmlWinEventLog

index=* sourcetype=xmlwineventlog | stats count by sourcetype

returns stats for sourcetype XmlWinEventLog and sourcetype xmlwineventlog.

agneticdk
Path Finder

I agree on the XmlWinEventLog vs xmlwineventlog. Splunk has something here that is not "normal" behavior.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...