Splunk Search

Case insensitive field extraction and reporting

rahiparikh
Explorer

Hi,

I am trying to extract a field from logs and generate report from it. Basically, I am trying to identify the authentication method.

My current search looks like -

 * | rex "(?<authentication_type>(?i)(password))" | search password

This extracts a field called authentication_type with value password. But, it considers Password and password to be two different values. Does anyone know how can I force splunk to consider both the same values?

Thanks,

Rahil

0 Karma
1 Solution

hazekamp
Builder

Splunk's search command is case insensitive. When creating a report, Splunk will consider these to be seperate values. If you want to make reporting commands insensitive to the case of a field, we can convert the field using eval and lower.

For example:

* | rex "(?<authentication_type>(?i)(password))" | eval authentication_type=lower(authentication_type) | search authentication_type=password

View solution in original post

hazekamp
Builder

Splunk's search command is case insensitive. When creating a report, Splunk will consider these to be seperate values. If you want to make reporting commands insensitive to the case of a field, we can convert the field using eval and lower.

For example:

* | rex "(?<authentication_type>(?i)(password))" | eval authentication_type=lower(authentication_type) | search authentication_type=password

rahiparikh
Explorer

Wow! I didn't know that one! Thanks! 🙂

0 Karma

hazekamp
Builder

That is correct. You can make the regular expression insensitive to case, but not the value extracted. Eval must be used @ search time for this.

0 Karma

lakshayanand
New Member

How to make regular expression insensitive to case?

0 Karma

rahiparikh
Explorer

So, what if I don't extract fields at search time but extract using the manager? Will splunk consider Password and password different? If so, am I always required to use eval and lower functions at reporting type?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...