While field values are not case sensitive by default on Splunk, when we use lookups the default setting for the field values is to be case sensitive.
I can't think of any valid use case of that inconsistency, is there any reason that I could possibly be missing?
note: I am aware that you can overwritte the case sensitivity setting when importing a lookup, I am merely wondering why doen't the default option for lookup field values align with the overall Splunk logic of field values being non case sensitive.
lookup [local=<bool>] [update=<bool>] <lookup-table-name> ( <lookup-field> [AS <event-field>] )... [ OUTPUT | OUTPUTNEW (<lookup-destfield> [AS <event-destfield>] )... ]
the default setting for the field values is to be case sensitive.
What are you talking about?
lookup arguments are
fieldname , not
lookup is not
It clearly isn't an assumption that field values are case insentivite and that field names are case sensitive on Splunk, that's clearly stated on the official Splunk documentation, and it's definitely not a wrong one: