Splunk Search

How to make a search case-sensitive?

SplunkTrust
SplunkTrust

How can I make a search case-sensitive? That is to say, I search for the general term "FOO" and want to only match "FOO" in results, and not "foo"

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

CASE(foo) will only return events with "foo", but not "FOO" or "Foo".

View solution in original post

Explorer

I am using SPLUNK Enterprise 6.1, your suggestion of using | where field="FOO" fails

0 Karma

Explorer

I want to perform a simple substring match that is case sensitive; for example find all occurrences of Test in a text file and ignore strings like test or test*. If you try CASE(Test) it fails? Any suggestions?

Path Finder

What Splunk's version are you using? Try it:

| where field="FOO"
0 Karma

Splunk Employee
Splunk Employee

CASE(foo) will only return events with "foo", but not "FOO" or "Foo".

View solution in original post

Explorer

and in a strange irony, the CASE command is case-sensitive

Splunk Employee
Splunk Employee

If the field is extracted: http://answers.splunk.com/questions/3485/can-i-make-field-values-case-sensitive

That thread also contains another technique if the field is not extracted.

Motivator

Hmm, I don't think you can turn case sensitivity on in the general search, but you should be able to hack it with rex:

foo | rex "(?<uppercase>FOO)" | search uppercase=*
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!