Splunk Search
Highlighted

Search query with like() func ignoring case

Engager

Hey all, need some help to something I didn't manage and couldn't find any solution online.

Assuming my data is of files and is indexed as JSON form as such:

{...some stuff..., FileContent: <this-file-content> ...some stuff...}

And what I want to do is find all files that have a certain word.
So, what I currently search is:

index=main source=.... | where like(FileContent, "%someword%")

But, I want to to ignore all the case of someword (SoMeWord would be found as well).

0 Karma
Highlighted

Re: Search query with like() func ignoring case

SplunkTrust
SplunkTrust

Use regular expressions if your actual matches are more complex: ... | regex FileContent="someword" or ... | where match(FileContent, "someword")
If all you want is case-sensitive search, use CASE(): http://docs.splunk.com/Documentation/Splunk/7.0.2/Search/UseCASEandTERMtomatchphrases

View solution in original post

Highlighted

Re: Search query with like() func ignoring case

Engager

Match is apparently what I needed and not like. Thanks!

0 Karma
Highlighted

Re: Search query with like() func ignoring case

Ultra Champion

Case sensitivity is a bit intricate with Splunk, but keep in mind that just FileContent = someword is case insensitive.

If you end up using search or where it gets interesting -

The following would work assuming someword as lower in the events -

    | search FileContent=someword  
    | search FileContent=Someword  
    | search FileContent="Someword" 
    | where  FileContent="someword" 

And these won't -

    | where FileContent=someword 
    | where FileContent="Someword" 

Meaning, the syntax of search is equivalent to the regular search string while where has regex syntax.

0 Karma
Highlighted

Re: Search query with like() func ignoring case

SplunkTrust
SplunkTrust

That's not quite accurate, where only uses regex when told to, e.g. when using match(). The equals sign is just that, a case sensitive equals sign. field=".*" won't be true unless field literally contains a dot and an asterisk.

Highlighted

Re: Search query with like() func ignoring case

Ultra Champion

Thank you @martin_mueller!

0 Karma