Getting Data In

Are sourcetype names case-sensitive?

Justin_Grant
Contributor

Yet another case-sensitivity question: are sourcetype names case-sensitive?

Labels (1)
0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

In search, no they are not. Note that this is very similar to the more general question:

http://answers.splunk.com/questions/65/are-field-values-case-sensitive

See my answer there. I go into a little more detail there which you might find interesting.

View solution in original post

anwarmian
Communicator

sourcetype in props.conf in case-senstive

[MySourcetype] is different from [mysourcetype]
From Splunk Documentation (pros.conf)

By default, [source::<source>] and [<sourcetype>] stanzas match in a
case-sensitive manner, while [host::<host>] stanzas match in a
case-insensitive manner. This is a convenient default, given that DNS names
are case-insensitive.



0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Well...in props.conf I think they will be (unless you express the stanza like: [::(?i)mYSourCeTypeName]. In thesearchcommand (which is implicit at the start of a query) they won't be, but forwherecomparisons in search queries,stats` values, etc., they will be.

It's not whether the names themselves are case-sensitive. It's whether whatever you're doing at the time is sensitive to the case of the names. It's more accurate to say that Splunk is case-sensitive in most places where you'd use a sourcetype name, and that the search command is actually an exception.

0 Karma

sideview
SplunkTrust
SplunkTrust

In search, no they are not. Note that this is very similar to the more general question:

http://answers.splunk.com/questions/65/are-field-values-case-sensitive

See my answer there. I go into a little more detail there which you might find interesting.

CerielTjuh
Path Finder

You can try this yourself 🙂

sourcetype="wineventlog:security"

instead of

sourcetype="WinEventLog:Security"

both work, so I'm assuming its not case sensitive

Zaphod
Engager

This is not my experience.

index=* sourcetype=Xmlwineventlog | stats count by sourcetype

returns stats for sourcetype XmlWinEventLog

index=* sourcetype=xmlwineventlog | stats count by sourcetype

returns stats for sourcetype XmlWinEventLog and sourcetype xmlwineventlog.

agneticdk
Path Finder

I agree on the XmlWinEventLog vs xmlwineventlog. Splunk has something here that is not "normal" behavior.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...