Splunk Search

How to ignore case sensitive input in lookup files?



I have created a lookup file with the 10 rows in my splunk search. But while i'm using the lookup facing lot of challenges. I mentioned the inputs in CAPS. Though Inputs are not in CAPs always, Example:

I have a lookup like below:

flavor, color
Chocolate, BROWN

I defined the color in CAPS, Sometimes we are logging the color in Small letters as Brown,brown.

Is there any way to ignore the case in lookupfile

Tags (1)

Path Finder

Recent versions of Splunk allow the setting to be changed through the Web UI. Click "Settings" > "Lookups" > "Lookup definitions" and find the look up you would like to modify. Check "advanced options" and either check or uncheck "Case sensitive match" depending on your preference.


Is this option still available?
I am using 7.1.2. and there is no such GUI option
This option needs to be set in the config file, which is not very optimal when someone opens and saves it and accidently removes it

0 Karma


hi @mathiask

am using splunk 7.1.1

It is available that option

click on your lookup file than one check box will appear with name of advanced options

0 Karma


- apparently it seems that this option is available for lookup files
- but is not available for KV store lookups

is this working as intended or just a minor oversight?
since it is possible to set this in the config file for KV store lookups.

0 Karma


i think it doesnt work. I still have to change the case to match the lookup field values.

0 Karma


Yes, in the transforms.conf where the lookup is defined, you can do this

case_sensitive_match = false

EDIT: This is no longer true: There is no way to set this from the Splunk user interface.
In Splunk 7.0, the transforms.conf setting now appears in the user interface.


While its true you can't ignore case in a lookup as part of a search, you can use the eval command and set all the values of a given field to lower (or upper) case.
I agree that the "right" way to do is to edit the transforms so that the lookup is case insensitive like 'normal' searches.


Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...