Splunk Search

CASE() search option produces no results

sloshburch
Splunk Employee
Splunk Employee

While using the CASE() feature of the search command (as per http://docs.splunk.com/Documentation/Splunk/6.0.2/Search/Usethesearchcommand#Use_CASE.28.29_and_TERM...) I'm seeing no events produced but there should be.

Example:

earliest=@h-15min latest=@h index=index1 OR index=index2 _raw="*Exception*"

produces results.

earliest=@h-15min latest=@h index=index1 OR index=index2 CASE(Exception)

produces NO results.

This seems to ONLY happen while using the string "Exception". Other strings within the CASE() function are working as expected.

This is on Splunk 6.0.2.

Anyone seen this before?

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Or use CASE(*Exception*). this will work same as _raw="*Exception*", just it will be case-sensitive.

View solution in original post

sloshburch
Splunk Employee
Splunk Employee

See somesoni2's comment for the answer to this question.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Thank you somesoni2 - I didn't realize it had that complete-word restriction. I also thought I had previously tried wildcards with no luck. I now see wildcards work.

Thanks everyone!

0 Karma

somesoni2
Revered Legend

Or use CASE(*Exception*). this will work same as _raw="*Exception*", just it will be case-sensitive.

lukejadamec
Super Champion

You might try TypeOfException

0 Karma

lukejadamec
Super Champion

That is not going to work with case. Read the bottom of the link you posted to see why. Or - what somesoni2 said.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

It's found preceded by letters org.something.somethingelse.somethingother.TypeOfException ending with a space or a :

0 Karma

somesoni2
Revered Legend

In my understanding, CASE does case-sensitive match for the a term/field values, which means it does a match for a complete word. So CASE(Exception) will match 'Exception' or 'Test.Exception.foo' but not 'OracleException' . _raw="Exception" will match a portion of a term as well hence you're getting results there. Check if Exception is a complete word/term in your logs.

0 Karma

lukejadamec
Super Champion

Is Exception surrounded by major breakers?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...