Splunk Search

Is there a way to make lookup NOT case sensitive

Splunk Employee
Splunk Employee

Let's say I have a lookup table that looks like this:

host,tmoapp somehost01,app01 somehost02,app01 anotherhost01,app02 anotherhost02,app02 ...

The issue is when a host field comes in from the agent as (say) 'SOMEHOST02'... That hostname will not get its tmoapp field correctly populated because the hostname case is wrong/different. What I would like is a way to do the lookup similar to 'grep -i' (i.e. case insensitive). Is this possible?

1 Solution

Splunk Employee
Splunk Employee

Well, if your lookup is a script, you can of course explicitly smash case. You could also explicitly smash the case in eval. ...|eval host=lower(host) | lookup ...

However given that our text is searched in a case-insensitive fashion, it seems like supporting lookups in an insensitive fashion should be possible, but I don't know if it currently is.

View solution in original post

Champion

In version 4.1.4, we provide an option to configure lookups to be case insensitive.

Sweet.

Motivator

Transforms.conf, underneath the stanza defining your lookup, casesensitivematch = false

Contributor

That IS sweet!!

0 Karma

Splunk Employee
Splunk Employee

What jrodman said is correct. Currently there is no ability to do case insensitive matching directly. You can either smash case in eval before calling the lookup operator, or use a scripted lookup where obviously you can do whatever type of matching you want.

Splunk Employee
Splunk Employee

Well, if your lookup is a script, you can of course explicitly smash case. You could also explicitly smash the case in eval. ...|eval host=lower(host) | lookup ...

However given that our text is searched in a case-insensitive fashion, it seems like supporting lookups in an insensitive fashion should be possible, but I don't know if it currently is.

View solution in original post

Splunk Employee
Splunk Employee