Splunk Cloud Platform

case insensitive search in inputlookup from a KV store

New Member

We are currently using an inputlookup command to populate a list based on some wild card searches using input tokens from a KV store lookup with customer details like below



| inputlookup $site$-patrondetails WHERE FirstName=$firstname|s$
patron = $patron_id|s$
LastName = $patron_surname|s$
ResAddr = $patron_address|s$
MobilePhone = $patron_mobile|s$



where the token values are based on the value the user types into an input text box and the site token is a drop down value.  

until recently we havinputlookup e had 2 sites where all the data in the source system is stored in uppercase but we have recently onboarded a 3rd site where the data is stored in both upper and lower case values.  as it turns out the where clause in is case sensitive. 

I have tried adding case_sensitive_match = false to the transform.conf stanza for this patrondetails lookup definition but this has not seemed to have any effect on the results being returned from the search. Have I missed something with this config or is there something else I need to add

Any help would be appreciated,


Labels (2)
0 Karma


Same issue here.

0 Karma


Me too. I also set case_sensitive_match = false.

As written in the documentation, I changed the values to lower ones in the KV Store. An exact match is working, but also when all values are lower ones in KV store i cannot use an Upper value to search for. 

| inputlookup XXX where field=value  does not work case insensitive

| inputlookup XXX | search field=value does work case insensitive

So it seems to be a bug in where

0 Karma

New Member

unfortunately the lookup I'm searching has 5 million rows and 25ish columns so Loading the whole lookup is not a practical solution

0 Karma


@TomWhiteI'm facing the same problem. Have you ever found a resolution for this?

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...