Making field names case insensitive

[bruceclarke]

All,

I'm wondering if there is any setting or workaround in place to just ignore the capitalization for all fields. In other words, "clientIp" and "ClientIp" would be the same. I know the coalesce function exists, so I could do something like

eval clientip=coalesce(clientip,clientIp,ClientIp)

but I'd really like to avoid having to do this if possible. Is there a way to make Splunk ignore case by default? I'm not too hopeful that a solution exists, since Splunk is essentially just parsing text, but I figured I would ask.

To give some context, we have build an internal resource that allows us to log certain details we want to Splunk. Unfortunately, people have been using inconsistent field names, so one event might have the field "workspaceId" while another would have the field "WorkspaceId". We want to transact on these fields, but doing so often requires us to coalesce the two fields first.

Thanks!

[lguinn2 · Accepted solution]

No, there is no way to make Splunk case-insensitive for field names. However, you can set a field alias, which gives a single field multiple names. Field aliases are persistent, so once you have created them you will no longer need to use coalesce or remember the alternate names. This is also good if people have done other variations, not just case (source_ip and src_ip for example).

You can manually set a field alias in props.conf (look here for info) or by going to Manager » Fields » Field aliases. Click New. In the form, give the alias any "name" that you like; you can call it "alias1." The important bits are:

(1) what sourcetype does this alias apply to?

(2) in the unlabelled (!) boxes, set originalFieldName = NewFieldName. Yes, I know that may be backwards from what you expect.

Also note that you can click "Add another field" to make several aliases at once for the sourcetype, if you like.

IMPORTANT: After you click Save, look at the alias you have created. In the Sharing column, note that the alias is listed as Private - which means that only you can use it. You need to fix that. Click the Permissions link. If you want to make the alias available to everyone, you must elevate its permissions. Note that you can make it visible only within the app or to All apps. First choose one of these, and then you can specify which roles can use the alias. Don't give write permissions to anyone else - unless you want them to be able to change/delete the alias. Read permissions are sufficient.

Using field aliases can also help you "normalize" field names across sourcetypes and apps, if you want. This is a technique that Splunk Apps often use to correlate event from many disparate sources.

HTH