Splunk Search

Field Values Case Sensitve

tmarlette
Motivator

I have a lookup table, with an ID field that has case specific alphanumeric values in it.

I'm attempting to search for a single user id, however when I put one in, I see at least two results for each, due to splunk seeing the values as case insensitive.

Here is an image. alt text

You'll notice the last letter's being of different case, yet even when using " around the field values, I still get this result set. Is there something that I am missing?

0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

| inputlookup xxx.csv | regex USER_ID="05000xpmX"

View solution in original post

tmarlette
Motivator

The answer I was looking for was to use an automatic lookup and force case sensitive matching. I'm sure I worded the question poorly, and this is what the working config looks like:

props.conf

[mysourcetype]
LOOKUP-SFDC-USER_NAME1 = lookup_usernames USER_ID AS USER_ID 

transforms.conf

[lookup_usernames]
filename = lookup_usernames.csv
case_sensitive_match=true

The way to search a table for a specific username is accepted above.

0 Karma

woodcock
Esteemed Legend

Try this:

| inputlookup xxx.csv | regex USER_ID="05000xpmX"

tmarlette
Motivator

This worked, thank you!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Nice. I wouldn't have thought of regex as a solution. Works, as long as the user id does not have special characters that translate differently in regex-land, in which case they need to be escaped.

0 Karma

sbbadri
Motivator

| inputlookup xxx.csv | eval USER_ID=case(05000xpmX)

0 Karma

tmarlette
Motivator

I tried this, and it doesn't work, Thank you!

0 Karma

somesoni2
Revered Legend

Use | where instead of | search.

0 Karma

guilmxm
Influencer

Hi,

Searching for fields values is not case sensitive, use the "where" command (in your case with the same syntax) or CASE():

|  makeresults |  eval foo="bar Bar" |  makemv foo | mvexpand foo
|  where foo=bar

or:

|  makeresults |  eval foo="bar Bar" |  makemv foo | mvexpand foo
|  search foo=CASE(bar)

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference

Cheers,

tmarlette
Motivator

This works for an individual user id, but how would I make an automatic lookup case sensitive? Is there a way?

0 Karma

guilmxm
Influencer

This works for any number of users ID, just use booleans as usually:

|  where foo=bar OR foo=bar2

OR:

|  search foo=CASE(bar) OR foo=CASE(bar2)

The search command will always be case non sensitive, whenever the fields comes an automatic lookup.
The only difference with automatic lookup fields will be the the field name (not the field value) will be case sensitive if it comes from a lookup. (while it is not the case with a raw data field)

Guilhem

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...