I have at least one lookup table where a field may be upper, lower or mixed case but the search value, pulled from log data to do the lookup, may not match the case. For example the log record may have:
cs_username = jk_midstate01
While the lookup table may have that field as:
cs_username = jk_MidState01
And it cannot be changed because the field is referenced in multiple places by different searches. It is not possible to change the case of either field. I put the following in etc\system\local\transforms.conf and restarted Splunk. At the same time I ensured there was no other place where the specific lookup table was referenced with the case_sensitive_match line.
case_sensitive_match = false
The searches I write to test the case insensitivity always fail, indicating to me that the transforms.conf entry is not valid. Of course the Splunk documentation is rife with meaty examples of using case_sensitive_match.
Note: My PC browser does not show all comments and does not give edit capability so I have to use my phone. Forgive my fat fingers.
Do not use the
[default] header stanza. Instead use your lookup name as the stanza header instead. I have done this dozens of times and never had a problem. I have never tried this setting in the
Ok.. I've made the changes to question to reflect that. Are you using lookup definition for your CSV lookup table file? Can you try adding
case_sensitive_match = false under the transforms.conf entry for that lookup definition?
Can you update your question to fix the typo? The location of the transforms.conf you update in the question is etc\system\trsansforms.conf, shouldn't that be etc/system/local/transforms.conf ? Also, why update the default stanza, why not for specific lookup definition (assuming you've already setup a lookup definition for your lookup table. These additional setting works only on lookup definitions)?
if you have to search, you can transforms in uppercase both your search results and lookup
your_search | eval cs_username=upper(cs_username) | search [| inputlookup your_lookup.csv | eval cs_username=upper(cs_username) | fields cs_username ] ...