Another options is to use the
regex command. In general, the
where option mentioned by Siegfried seems like the best for your specific usage scenario, but
regex would be more flexible when:
wherecommand, so you can't do
| where myid="*pACDD1K002"to case-sensitively match a suffix.)
Matching part of a raw event:
sourcetype=whatever 0ZP0YFS5Rl7pACDD1K002 | regex _raw="\b0ZP0YFS5Rl7pACDD1K002\b"
A partial-field matching example:
sourcetype=whatever myid="*pACDD1K002" | regex myid=".*pACDD1K002$"
Please ensure that you include enough of the text search string in the base query to ensure that the search is efficiently using the index, e.g.,
sourcetype=whatever "0ZP0YFS5Rl7pACDD1K002" | regex _raw="\b0ZP0YFS5Rl7pACDD1K002\b" should be a much faster search.
values do not have case-sensitivity. operations on values may have sensitivity to the case of the values. there is no global way to make every possible operation and function in Splunk case-insensitive, and besides "search", most are case-sensitive. You can of course always normalize most values using the "upper()" or "lower()" eval functions, but (for example) this can't be applied to match values in lookup tables.
You should instead code the above as: sourcetype=whatever myid="0ZP0YFS5Rl7pACDD1K002" | where myid="0ZP0YFS5Rl7pACDD1K002". If you do not do so, the search will likely be much less efficient, as it will need to bring back everything from the sourcetype without taking advantage of the index, then filter it with
where. Instead, bring back only the items that match, regardless of case. This should be a much smaller set and efficiently retrieved via the index, and you then are simply filtering out on a much smaller set.