Splunk Search

Splunk Case-Sensitive Search

alexspunkshell
Contributor

Hi,

Can someone help me with the regex command for below?

| search ="UPN=*T@mail.cloud"

Thanks in advance!

 

Labels (2)
0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

To validate your ask: You are currently getting both email addresses that end in lowercase and uppercase 'T', because of the default case-insensitivity of search. You need help figuring out how to only return email addresses that have an uppercase 'T' before the '@mail.cloud'.

Is that what you are really asking?

If so, use the CASE function to interpret your search term exactly as typed: 

| search UPN=CASE(*T@mail.cloud)

View solution in original post

aasabatini
Motivator

Hi @alexspunkshell 

Can you specify little bit better your request?

you write this:

| search ="UPN=*T@mail.cloud"

but the search comand don't need the "=" symbol

correct example:

| search UPN="*T@mail.cloud"

 

Ale

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

alexspunkshell
Contributor

@aasabatini  Thanks for your reply.

Yes I need regex for

| search UPN=*T@mail.cloud

If I apply this in my query then, I am also getting results for UPN= t*@mail.cloud also getting due to case sensitivity.

 

Please help me with regex for

| search UPN=*T@mail.cloud

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

To validate your ask: You are currently getting both email addresses that end in lowercase and uppercase 'T', because of the default case-insensitivity of search. You need help figuring out how to only return email addresses that have an uppercase 'T' before the '@mail.cloud'.

Is that what you are really asking?

If so, use the CASE function to interpret your search term exactly as typed: 

| search UPN=CASE(*T@mail.cloud)
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...