Is there any reason that there are some command parameters that needs uppercase to work and some can use both lower and uppercase?
Eks both of this does work
| timechart count by index
| timechart count BY index
Same with these, works fine.
| lookup dnslookup clientip as src_ip
| lookup dnslookup clientip AS src_ip
But this fails
index in (test1 test2)
Needs to be uppercase
index IN (test1 test2)
cat or dog
cat OR dog
Where do I find a list and regulation on when to use upper/Lowercase (IN OR AND BY AS etc)?
Usually, you find this info in notes under each documentation about commands/operators.Example you can check this link: https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/Search/Booleanexpressions
Here the document says: The operators must be capitalized.It is best to use capital letters for all clauses like AS, BY, IN and operators (OR, AND, NOT).
View solution in original post