Splunk Search

Search terms are case sensitive or case insensitive.

palisetty
Communicator

Search terms are case sensitive or case insensitive?
(components of search language)?

For me, the answer is case sensitive but Quizlet says case insensitive. To verify, I tried it on the search bar and when I type "Index", it doesn't produce any results while I type "index", I see the events on the event list.

I am sorry I am asking some questions from Quizlet as it contradicts my understanding and I am just trying to make sure I am correct.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

There is a difference between field names and field values. The former are case-SENSITIVE, the latter are case-INsensitive. You can alter the latter by using the CASE() feature. Now search terms are also case-INsensitive. These are the text strings in a foundational search that do not use an equals sign. In other words, anything not like FIeldName="field value". So your search might look like this:

index="caseINsensitive" AND sourcetype="caseINsensitive" AND FieldNameCaseSENSITIVE="FieldValueCaseINsensitive" AND search AND "terms" AND are AND also AND case AND "INsensitive" OR (CASE(thisIsCaseSENSITIVE) OR TERM(thisIsCaseINsensitive))

View solution in original post

woodcock
Esteemed Legend

There is a difference between field names and field values. The former are case-SENSITIVE, the latter are case-INsensitive. You can alter the latter by using the CASE() feature. Now search terms are also case-INsensitive. These are the text strings in a foundational search that do not use an equals sign. In other words, anything not like FIeldName="field value". So your search might look like this:

index="caseINsensitive" AND sourcetype="caseINsensitive" AND FieldNameCaseSENSITIVE="FieldValueCaseINsensitive" AND search AND "terms" AND are AND also AND case AND "INsensitive" OR (CASE(thisIsCaseSENSITIVE) OR TERM(thisIsCaseINsensitive))

palisetty
Communicator

Perfect. Thank you so much for patiently clearing my issue. Happy New Year

0 Karma

palisetty
Communicator

@woodcock What are called search terms, please?

0 Karma

woodcock
Esteemed Legend

See my updated answer.

0 Karma

palisetty
Communicator

@woodcock any one example of not like fieldname=fieldvalue, please.

0 Karma

woodcock
Esteemed Legend

See my updated answer.

0 Karma

palisetty
Communicator

@woodcock @gcusello As far as I know, Search terms are something before '|'. If we take that into consideration, we have index="main", here 'index' is Field Name which is case sensitive, "main" is Field value which is not case sensitive. But we are calling search terms are not case sensitive, i am confused, kindly help.

0 Karma

vnravikumar
Champion

Hi

Field values are not case sensitive.
Field names are always case sensitive.

palisetty
Communicator

That is correct, I was thinking search terms come under everything before '|'. I forgot about Field Names and Field Values. Thank you for correcting me.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...