Splunk Search

Can I make field values case-sensitive?

maverick
Splunk Employee
Splunk Employee

Is there a way to enforce case-sensitivity on a field by field basis?

Example:

myid="0ZP0YFS5Rl7pACDD1K002"

and

myid="0ZP0YFS5Rl7pACDD1k002"

where the lower-case k at the far right of the value makes these two field values different.

1 Solution

ziegfried
Influencer

You can use the where command to enforce case sensitivity:

sourcetype=whatever | where myid="0ZP0YFS5Rl7pACDD1K002"

View solution in original post

Lowell
Super Champion

Another options is to use the regex command. In general, the where option mentioned by Siegfried seems like the best for your specific usage scenario, but regex would be more flexible when:

  1. Trying to case-sensitively match text within the raw event (e.g. if a specific field is not already defined)
  2. Trying to match part of a field (because wildcard expansion does not work with the where command, so you can't do | where myid="*pACDD1K002" to case-sensitively match a suffix.)

Matching part of a raw event:

sourcetype=whatever 0ZP0YFS5Rl7pACDD1K002 | regex _raw="\b0ZP0YFS5Rl7pACDD1K002\b"

A partial-field matching example:

sourcetype=whatever myid="*pACDD1K002" | regex myid=".*pACDD1K002$"

gkanapathy
Splunk Employee
Splunk Employee

Please ensure that you include enough of the text search string in the base query to ensure that the search is efficiently using the index, e.g., sourcetype=whatever "0ZP0YFS5Rl7pACDD1K002" | regex _raw="\b0ZP0YFS5Rl7pACDD1K002\b" should be a much faster search.

gkanapathy
Splunk Employee
Splunk Employee

values do not have case-sensitivity. operations on values may have sensitivity to the case of the values. there is no global way to make every possible operation and function in Splunk case-insensitive, and besides "search", most are case-sensitive. You can of course always normalize most values using the "upper()" or "lower()" eval functions, but (for example) this can't be applied to match values in lookup tables.

ziegfried
Influencer

You can use the where command to enforce case sensitivity:

sourcetype=whatever | where myid="0ZP0YFS5Rl7pACDD1K002"

gkanapathy
Splunk Employee
Splunk Employee

You should instead code the above as: sourcetype=whatever myid="0ZP0YFS5Rl7pACDD1K002" | where myid="0ZP0YFS5Rl7pACDD1K002". If you do not do so, the search will likely be much less efficient, as it will need to bring back everything from the sourcetype without taking advantage of the index, then filter it with where. Instead, bring back only the items that match, regardless of case. This should be a much smaller set and efficiently retrieved via the index, and you then are simply filtering out on a much smaller set.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...