Security

Splunk Automatic Lookups and Capitlization

jmcclure
Explorer

What is a work around for case sensitive automatic lookups? I am trying to build out an automatic lookup for users and the users are all different types of capitilization. I am doing a pull from ldap dropping it into a CSV and then having a custom Splunk command execute a python script that that duplicates every row with different user capitilization. BUT I still am having issues with one offs...

I know caculated fields could work BUT they are after lookups in searchtime calculations

Tags (1)
0 Karma
1 Solution

starcher
Influencer

See option for case_sensitive_match =

In the lookups stanza for transforms.conf
https://docs.splunk.com/Documentation/Splunk/7.0.3/Admin/Transformsconf

View solution in original post

starcher
Influencer

See option for case_sensitive_match =

In the lookups stanza for transforms.conf
https://docs.splunk.com/Documentation/Splunk/7.0.3/Admin/Transformsconf

jmcclure
Explorer

Will that work with CSV lookups or jsut KSV? I'm diong a pull from Active Directory, dropping it into a CSV file and then creating lookups

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...