Splunk Search

Case insensitive field extraction and reporting

rahiparikh
Explorer

Hi,

I am trying to extract a field from logs and generate report from it. Basically, I am trying to identify the authentication method.

My current search looks like -

 * | rex "(?<authentication_type>(?i)(password))" | search password

This extracts a field called authentication_type with value password. But, it considers Password and password to be two different values. Does anyone know how can I force splunk to consider both the same values?

Thanks,

Rahil

0 Karma
1 Solution

hazekamp
Builder

Splunk's search command is case insensitive. When creating a report, Splunk will consider these to be seperate values. If you want to make reporting commands insensitive to the case of a field, we can convert the field using eval and lower.

For example:

* | rex "(?<authentication_type>(?i)(password))" | eval authentication_type=lower(authentication_type) | search authentication_type=password

View solution in original post

hazekamp
Builder

Splunk's search command is case insensitive. When creating a report, Splunk will consider these to be seperate values. If you want to make reporting commands insensitive to the case of a field, we can convert the field using eval and lower.

For example:

* | rex "(?<authentication_type>(?i)(password))" | eval authentication_type=lower(authentication_type) | search authentication_type=password

rahiparikh
Explorer

Wow! I didn't know that one! Thanks! 🙂

0 Karma

hazekamp
Builder

That is correct. You can make the regular expression insensitive to case, but not the value extracted. Eval must be used @ search time for this.

0 Karma

lakshayanand
New Member

How to make regular expression insensitive to case?

0 Karma

rahiparikh
Explorer

So, what if I don't extract fields at search time but extract using the manager? Will splunk consider Password and password different? If so, am I always required to use eval and lower functions at reporting type?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...