Knowledge Management

Case in lookup values

huibertsp
Engager

I am trying a lookup search and I get some empty spaces (not all). My data has mixed case values between 'host' column from my logs and 'name' column from my Lookups. Is there a way to make the match case-insensitive or do like a UPPER() or LOWER() on both matching sides?

index=iis
| lookup ListOf_servers name as host OUTPUT description, comment
| table host description, comment
| dedup host

Tags (1)
0 Karma

huibertsp
Engager

Under Lookup Definitions / / Advanced Option --> Uncheck 'Case sensitive match'

Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...