You can try this yourself 🙂
both work, so I'm assuming its not case sensitive
In search, no they are not. Note that this is very similar to the more general question:
See my answer there. I go into a little more detail there which you might find interesting.
props.conf I think they will be (unless you express the stanza like:
[::(?i)mYSourCeTypeName]. In thesearch
command (which is implicit at the start of a query) they won't be, but forwhere
comparisons in search queries,stats` values, etc., they will be.
It's not whether the names themselves are case-sensitive. It's whether whatever you're doing at the time is sensitive to the case of the names. It's more accurate to say that Splunk is case-sensitive in most places where you'd use a sourcetype name, and that the
search command is actually an exception.