How to make a search case-sensitive?

[muebel]

How can I make a search case-sensitive? That is to say, I search for the general term "FOO" and want to only match "FOO" in results, and not "foo"

[jburman123]

I am using SPLUNK Enterprise 6.1, your suggestion of using | where field="FOO" fails

[jburman123]

I want to perform a simple substring match that is case sensitive; for example find all occurrences of Test in a text file and ignore strings like test or test*. If you try CASE(Test) it fails? Any suggestions?

[Nikita_Danilov]

What Splunk's version are you using? Try it:

| where field="FOO"

[cyue_splunk · Accepted solution]

CASE(foo) will only return events with "foo", but not "FOO" or "Foo".

[northben]

and in a strange irony, the CASE command is case-sensitive

[bwooden]

If the field is extracted: http://answers.splunk.com/questions/3485/can-i-make-field-values-case-sensitive

That thread also contains another technique if the field is not extracted.

[ftk]

Hmm, I don't think you can turn case sensitivity on in the general search, but you should be able to hack it with rex:

foo | rex "(?<uppercase>FOO)" | search uppercase=*