Is there a way to enforce case-sensitivity on a field by field basis?
Example:
myid="0ZP0YFS5Rl7pACDD1K002"
and
myid="0ZP0YFS5Rl7pACDD1k002"
where the lower-case k at the far right of the value makes these two field values different.
You can use the where
command to enforce case sensitivity:
sourcetype=whatever | where myid="0ZP0YFS5Rl7pACDD1K002"
Another options is to use the regex
command. In general, the where
option mentioned by Siegfried seems like the best for your specific usage scenario, but regex
would be more flexible when:
where
command, so you can't do | where myid="*pACDD1K002"
to case-sensitively match a suffix.)Matching part of a raw event:
sourcetype=whatever 0ZP0YFS5Rl7pACDD1K002 | regex _raw="\b0ZP0YFS5Rl7pACDD1K002\b"
A partial-field matching example:
sourcetype=whatever myid="*pACDD1K002" | regex myid=".*pACDD1K002$"
Please ensure that you include enough of the text search string in the base query to ensure that the search is efficiently using the index, e.g., sourcetype=whatever "0ZP0YFS5Rl7pACDD1K002" | regex _raw="\b0ZP0YFS5Rl7pACDD1K002\b"
should be a much faster search.
values do not have case-sensitivity. operations on values may have sensitivity to the case of the values. there is no global way to make every possible operation and function in Splunk case-insensitive, and besides "search", most are case-sensitive. You can of course always normalize most values using the "upper()" or "lower()" eval functions, but (for example) this can't be applied to match values in lookup tables.
You can use the where
command to enforce case sensitivity:
sourcetype=whatever | where myid="0ZP0YFS5Rl7pACDD1K002"
You should instead code the above as: sourcetype=whatever myid="0ZP0YFS5Rl7pACDD1K002" | where myid="0ZP0YFS5Rl7pACDD1K002". If you do not do so, the search will likely be much less efficient, as it will need to bring back everything from the sourcetype without taking advantage of the index, then filter it with where
. Instead, bring back only the items that match, regardless of case. This should be a much smaller set and efficiently retrieved via the index, and you then are simply filtering out on a much smaller set.