Splunk Case-Sensitive Search

[alexspunkshell]

Hi,

Can someone help me with the regex command for below?

| search ="UPN=*[email protected]"

Thanks in advance!

[aasabatini]

Hi @alexspunkshell 

Can you specify little bit better your request?

you write this:

| search ="UPN=*[email protected]"

but the search comand don't need the "=" symbol

correct example:

| search UPN="*[email protected]"

Ale

[alexspunkshell]

@aasabatini  Thanks for your reply.

Yes I need regex for

| search UPN=*[email protected]

If I apply this in my query then, I am also getting results for UPN= t*@mail.cloud also getting due to case sensitivity.

Please help me with regex for

| search UPN=*[email protected]

[s2_splunk · Accepted solution]

To validate your ask: You are currently getting both email addresses that end in lowercase and uppercase 'T', because of the default case-insensitivity of search. You need help figuring out how to only return email addresses that have an uppercase 'T' before the '@mail.cloud'.

Is that what you are really asking?

If so, use the CASE function to interpret your search term exactly as typed: 

| search UPN=CASE(*[email protected])