Splunk Search

How to make a search case-sensitive?

muebel
SplunkTrust
SplunkTrust

How can I make a search case-sensitive? That is to say, I search for the general term "FOO" and want to only match "FOO" in results, and not "foo"

Tags (2)
1 Solution

cyue_splunk
Splunk Employee
Splunk Employee

CASE(foo) will only return events with "foo", but not "FOO" or "Foo".

View solution in original post

jburman123
Explorer

I am using SPLUNK Enterprise 6.1, your suggestion of using | where field="FOO" fails

0 Karma

jburman123
Explorer

I want to perform a simple substring match that is case sensitive; for example find all occurrences of Test in a text file and ignore strings like test or test*. If you try CASE(Test) it fails? Any suggestions?

Nikita_Danilov
Path Finder

What Splunk's version are you using? Try it:

| where field="FOO"
0 Karma

cyue_splunk
Splunk Employee
Splunk Employee

CASE(foo) will only return events with "foo", but not "FOO" or "Foo".

northben
Explorer

and in a strange irony, the CASE command is case-sensitive

bwooden
Splunk Employee
Splunk Employee

If the field is extracted: http://answers.splunk.com/questions/3485/can-i-make-field-values-case-sensitive

That thread also contains another technique if the field is not extracted.

ftk
Motivator

Hmm, I don't think you can turn case sensitivity on in the general search, but you should be able to hack it with rex:

foo | rex "(?<uppercase>FOO)" | search uppercase=*
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...