Splunk Cloud Platform

case insensitive search in inputlookup from a KV store

TomWhite
New Member

We are currently using an inputlookup command to populate a list based on some wild card searches using input tokens from a KV store lookup with customer details like below

 

 

| inputlookup $site$-patrondetails WHERE FirstName=$firstname|s$
patron = $patron_id|s$
LastName = $patron_surname|s$
ResAddr = $patron_address|s$
MobilePhone = $patron_mobile|s$

 

 


where the token values are based on the value the user types into an input text box and the site token is a drop down value.  

until recently we havinputlookup e had 2 sites where all the data in the source system is stored in uppercase but we have recently onboarded a 3rd site where the data is stored in both upper and lower case values.  as it turns out the where clause in is case sensitive. 

I have tried adding case_sensitive_match = false to the transform.conf stanza for this patrondetails lookup definition but this has not seemed to have any effect on the results being returned from the search. Have I missed something with this config or is there something else I need to add

Any help would be appreciated,

Tom

Labels (2)
0 Karma

tomasmoser
Contributor

Same issue here.

0 Karma

dschroeter
Explorer

Me too. I also set case_sensitive_match = false.

As written in the documentation, I changed the values to lower ones in the KV Store. An exact match is working, but also when all values are lower ones in KV store i cannot use an Upper value to search for. 

| inputlookup XXX where field=value  does not work case insensitive

| inputlookup XXX | search field=value does work case insensitive

So it seems to be a bug in where

0 Karma

TomWhite
New Member

unfortunately the lookup I'm searching has 5 million rows and 25ish columns so Loading the whole lookup is not a practical solution

0 Karma

dominikatvastli
Explorer

@TomWhiteI'm facing the same problem. Have you ever found a resolution for this?

Get Updates on the Splunk Community!

Cloud Platform | Customer Change Announcement: Email Notification Will Be Available ...

The Notification Team is migrating our email service provider since currently there’s no support ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...