Are function names case-sensitive?

[pm771]

The following query did not return any results:

... | stats count(EVAL(error_code=2000)) ...

I had to use lower-case eval to make it work.

Is it a general rule or a specific case?

[lfedak_splunk]

Hey @pm771 and @sukisen1981, check out the answers and comments on this post: https://answers.splunk.com/answers/46/are-search-language-keywords-case-sensitive.html for some more info.
The free Splunk Fundamentals 1 course also runs through the basics of what is case-sensitive and case-insensitive if you'd like to drill that in. Based on these comments it looks like anything related to stats has to be lowercase at all times.

[Sukisen1981]

@lfedak_splunk - thanks for the link. Just to add a bit more. if I do something like
| eval x= .... vs EVAL X=....
results are same
BUT
if I combine it with stats then the upper case EVAL does not work.
So, I guess what @lfedak_splunk says, 'Based on these comments it looks like anything related to stats has to be lowercase at all times.' is the correct answer

[pm771]

@lfedak_splunk:

Is it just stats or timechart as well?

[DalJeanis]

@pm771 - all those other verbs are effectively just skins for stats - chart, timechart, eventstats and so on. But, regardless, it's best to stick to lower case for verbs and functions, and upper case for Boolean operators. Home grown functions and macros, use the case you wrote them in.

[Sukisen1981]

hmm this is a fantastic question - I tried with my own test data , and you are right.
HOWEVER, i could not find any splunk documentation that explicitly points this out.
Maybe @lfedak_splunk can shed some more light on this?