Can I make field values case-sensitive?

Question

Is there a way to enforce case-sensitivity on a field by field basis?

Example:

myid="0ZP0YFS5Rl7pACDD1K002"

and

myid="0ZP0YFS5Rl7pACDD1k002"

where the lower-case k at the far right of the value makes these two field values different.

Accepted Answer

4

You can use the where command to enforce case sensitivity:

sourcetype=whatever | where myid="0ZP0YFS5Rl7pACDD1K002"

link

answered 09 Jun '10, 20:16

ziegfried ♦
7.1k●1●3●15
accept rate: 53%

1

You should instead code the above as: sourcetype=whatever myid="0ZP0YFS5Rl7pACDD1K002" | where myid="0ZP0YFS5Rl7pACDD1K002". If you do not do so, the search will likely be much less efficient, as it will need to bring back everything from the sourcetype without taking advantage of the index, then filter it with where. Instead, bring back only the items that match, regardless of case. This should be a much smaller set and efficiently retrieved via the index, and you then are simply filtering out on a much smaller set.

(08 Sep '10, 17:40) gkanapathy ♦

Answer 2

values do not have case-sensitivity. operations on values may have sensitivity to the case of the values. there is no global way to make every possible operation and function in Splunk case-insensitive, and besides "search", most are case-sensitive. You can of course always normalize most values using the "upper()" or "lower()" eval functions, but (for example) this can't be applied to match values in lookup tables.

Answer 3

Another options is to use the regex command. In general, the where option mentioned by Siegfried seems like the best for your specific usage scenario, but regex would be more flexible when:

Trying to case-sensitively match text within the raw event (e.g. if a specific field is not already defined)
Trying to match part of a field (because wildcard expansion does not work with the where command, so you can't do | where myid="*pACDD1K002" to case-sensitively match a suffix.)

Matching part of a raw event:

sourcetype=whatever 0ZP0YFS5Rl7pACDD1K002 | regex _raw="\b0ZP0YFS5Rl7pACDD1K002\b"

A partial-field matching example:

sourcetype=whatever myid="*pACDD1K002" | regex myid=".*pACDD1K002$"

Can I make field values case-sensitive?

Follow this question

Splunk Resources

Related questions