Splunk Enterprise

Uppercase, Lowercase confusion in Splunk commands

jotne
Path Finder

Is there any reason that there are some command parameters that needs uppercase to work and some can use both lower and uppercase?

Eks both of this does work

| timechart count by index

| timechart count BY index

Same with these, works fine.

| lookup dnslookup clientip as src_ip

| lookup dnslookup clientip AS src_ip

But this fails

index in (test1 test2)

Needs to be uppercase

index IN (test1 test2)

 

This fails

cat or dog

Needs to be uppercase

cat OR dog

Where do I find a list and regulation on when to use upper/Lowercase (IN OR AND BY AS etc)?

Labels (1)
0 Karma
1 Solution

manjunathmeti
Champion

Usually, you find this info in notes under each documentation about commands/operators.

Example you can check this link: https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/Search/Booleanexpressions

Here the document says: The operators must be capitalized.

It is best to use capital letters for all clauses like AS, BY, IN and operators (OR, AND, NOT).

View solution in original post

0 Karma

manjunathmeti
Champion

Usually, you find this info in notes under each documentation about commands/operators.

Example you can check this link: https://docs.splunk.com/Documentation/SplunkCloud/8.1.2012/Search/Booleanexpressions

Here the document says: The operators must be capitalized.

It is best to use capital letters for all clauses like AS, BY, IN and operators (OR, AND, NOT).

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!