Splunk Cloud
Provide Splunk Cloud feedback in this confidential UX survey by June 17
for a chance to win a $200 Amazon gift card!

case insensitive search in inputlookup from a KV store

New Member

We are currently using an inputlookup command to populate a list based on some wild card searches using input tokens from a KV store lookup with customer details like below



| inputlookup $site$-patrondetails WHERE FirstName=$firstname|s$
patron = $patron_id|s$
LastName = $patron_surname|s$
ResAddr = $patron_address|s$
MobilePhone = $patron_mobile|s$



where the token values are based on the value the user types into an input text box and the site token is a drop down value.  

until recently we havinputlookup e had 2 sites where all the data in the source system is stored in uppercase but we have recently onboarded a 3rd site where the data is stored in both upper and lower case values.  as it turns out the where clause in is case sensitive. 

I have tried adding case_sensitive_match = false to the transform.conf stanza for this patrondetails lookup definition but this has not seemed to have any effect on the results being returned from the search. Have I missed something with this config or is there something else I need to add

Any help would be appreciated,


Labels (2)
0 Karma


Me too. I also set case_sensitive_match = false.

As written in the documentation, I changed the values to lower ones in the KV Store. An exact match is working, but also when all values are lower ones in KV store i cannot use an Upper value to search for. 

| inputlookup XXX where field=value  does not work case insensitive

| inputlookup XXX | search field=value does work case insensitive

So it seems to be a bug in where

0 Karma

New Member

unfortunately the lookup I'm searching has 5 million rows and 25ish columns so Loading the whole lookup is not a practical solution

0 Karma


@TomWhiteI'm facing the same problem. Have you ever found a resolution for this?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!