Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Search terms are case sensitive or case insens...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Search terms are case sensitive or case insensitive?
(components of search language)?
For me, the answer is case sensitive but Quizlet says case insensitive. To verify, I tried it on the search bar and when I type "Index", it doesn't produce any results while I type "index", I see the events on the event list.
I am sorry I am asking some questions from Quizlet as it contradicts my understanding and I am just trying to make sure I am correct.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is a difference between field names and field values. The former are case-SENSITIVE, the latter are case-INsensitive. You can alter the latter by using the CASE() feature. Now search terms are also case-INsensitive. These are the text strings in a foundational search that do not use an equals sign. In other words, anything not like FIeldName="field value". So your search might look like this:
index="caseINsensitive" AND sourcetype="caseINsensitive" AND FieldNameCaseSENSITIVE="FieldValueCaseINsensitive" AND search AND "terms" AND are AND also AND case AND "INsensitive" OR (CASE(thisIsCaseSENSITIVE) OR TERM(thisIsCaseINsensitive))
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is a difference between field names and field values. The former are case-SENSITIVE, the latter are case-INsensitive. You can alter the latter by using the CASE() feature. Now search terms are also case-INsensitive. These are the text strings in a foundational search that do not use an equals sign. In other words, anything not like FIeldName="field value". So your search might look like this:
index="caseINsensitive" AND sourcetype="caseINsensitive" AND FieldNameCaseSENSITIVE="FieldValueCaseINsensitive" AND search AND "terms" AND are AND also AND case AND "INsensitive" OR (CASE(thisIsCaseSENSITIVE) OR TERM(thisIsCaseINsensitive))
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Perfect. Thank you so much for patiently clearing my issue. Happy New Year
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@woodcock What are called search terms, please?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
See my updated answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@woodcock any one example of not like fieldname=fieldvalue, please.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
See my updated answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@woodcock @gcusello As far as I know, Search terms are something before '|'. If we take that into consideration, we have index="main", here 'index' is Field Name which is case sensitive, "main" is Field value which is not case sensitive. But we are calling search terms are not case sensitive, i am confused, kindly help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
Field values are not case sensitive.
Field names are always case sensitive.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That is correct, I was thinking search terms come under everything before '|'. I forgot about Field Names and Field Values. Thank you for correcting me.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
