Getting Data In

How do I filter data with upper case and lower case sensitive scenarios?

athorat
Communicator

Is there a way to restrict this search with upper case and lower case scenarios?

index=aap_prod sourcetype="HDP:PROD:OOZIE"  
  (":start:] with user-retry state" OR "@end***]Action updated in DB!") 

When I use this @end***, it also returns results with END_IMPORT***, which is an event detail for failed jobs.

Two different search scenarios

Tags (2)
0 Karma

Yasaswy
Contributor

Hi , you can try something like
index=aap_prod sourcetype="HDP:PROD:OOZIE" (":start:] with user-retry state" OR CASE(@end***]Action updated in DB))

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...