Is there any reason that there are some command parameters that needs uppercase to work and some can use both lower and uppercase?
Eks both of this does work
| timechart count by index
| timechart count BY index
Same with these, works fine.
| lookup dnslookup clientip as src_ip
| lookup dnslookup clientip AS src_ip
But this fails
index in (test1 test2)
Needs to be uppercase
index IN (test1 test2)
This fails
cat or dog
Needs to be uppercase
cat OR dog
Where do I find a list and regulation on when to use upper/Lowercase (IN OR AND BY AS etc)?
Usually, you find this info in notes under each documentation about commands/operators.
Example you can check this link: https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/Search/Booleanexpressions
Here the document says: The operators must be capitalized.
It is best to use capital letters for all clauses like AS, BY, IN and operators (OR, AND, NOT).
Usually, you find this info in notes under each documentation about commands/operators.
Example you can check this link: https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/Search/Booleanexpressions
Here the document says: The operators must be capitalized.
It is best to use capital letters for all clauses like AS, BY, IN and operators (OR, AND, NOT).