Splunk Search

How to make case InSensitive search everywhere by default?

Nikita_Danilov
Path Finder

Hi all,

I need to make by default all searches in Splunk 6.1.1 as case InSensitive.
For example, this search are case InSensitive:

index=_internal log_level=info

But this search are case Sensitive:

index=_internal | where log_level=info

Hm, strange... Why? Maybe it's bug and I need to report about it? How can I set default case InSensitive search everywhere? I know about function lower(), but it's just particular solution.

Thanks.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

That's not a bug, Splunk is case sensitive except in the search command. (Maybe there's a few more exceptions...)

In your example, you could do this:

index=_internal | ... | search log_level=info

That'll find info, Info, INFO, ...

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

That's not a bug, Splunk is case sensitive except in the search command. (Maybe there's a few more exceptions...)

In your example, you could do this:

index=_internal | ... | search log_level=info

That'll find info, Info, INFO, ...

martin_mueller
SplunkTrust
SplunkTrust

Dunno. lower() should be pretty quick, and match() with a fast regular expression such as this one anchored to both ends without any multiplicity or options should be pretty quick as well.

Here's another option, didn't test its speed:

count(eval(searchmatch("log_level=info")))
0 Karma

Nikita_Danilov
Path Finder

Does match(,) have better performance than lower()?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

count(eval(match(log_level, "(?i)^info$")))

Or this for much more readability in case you have multiple long statements:

... | eval info_level = if(match(log_level, "(?i)^info$"), 1, 0) | stats sum(info_level)

The other answers you found may be referring to the search command, that indeed does treat values as case insensitive.

0 Karma

Nikita_Danilov
Path Finder

Martin, thanks, but what about count(eval(log_level=info))? I need to use everywhere lower()? Where I can find information about this "exceptions"? This case surprised me, because in other Answers people say that "Splunk is case InSensitive".

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...