How to run search on lookup file with case insensitive

[rashi83]

hi ,
I have a lookup file with million of records, there are user name with lower or upper case. I need to match the user name irrespective of case. I have added a lookup defn ( with case sensitive check box unticked). I can see in transform.conf that match_case_sensitive=0
But still search is running with case sensitive.

I am using Splunk 8.0. Any suggestions?

[woodcock · Accepted solution]

You have to perform your lookup through the lookup definition, not the lookup file so try using lookupsplunk (or whatever the name of your lookup definition is), instead of lookupsplunk.csv, like this:

index="x" AND sourcetype="Y"
| rex "(?:Users%5C)(?(.*))(?:%5C(AppData|Desk))"
| lookup lookupsplunk user AS UserID OUTPUT Office Country UserName

[rashi83]

Awesome , thank you very much !!

[to4kawa]

index="x" 
| rex field=_raw "(?:Users%5C)(?<UserID>(.*))(?:%5C(AppData|Desk))" 
| inputlookup lookupspluk.csv append=t 
| eval UserID=coalesce(lower(UserId),lower(user))
| eventstats values(Office) as Office ,values(Country) as Country ,values(UserName) as UserName by UserID

at first, check your POST message, some strings is missing.
and let's make a lookup with lowercase or uppercase username.

[woodcock]

Show us your search SPL.

[rashi83]

index="x" | rex field=_raw "(?:Users%5C)(?(.*))(?:%5C(AppData|Desk))" | lookup lookupspluk.csv user as UserID OUTPUT Office,Country,UserName

[rashi83]

@woodcock - any suggestions. M still stuck , even though I have the stanza in transform.conf . I have also tried to put 0 in place of false

[ColleagueLookup]
filename = colleaguecountry_splunk_NewSQL.csv
case_sensitive_match = false