Is there a way to make lookup NOT case sensitive

[Jaci]

Let's say I have a lookup table that looks like this:

host,tmoapp somehost01,app01 somehost02,app01 anotherhost01,app02 anotherhost02,app02 ...

The issue is when a host field comes in from the agent as (say) 'SOMEHOST02'... That hostname will not get its tmoapp field correctly populated because the hostname case is wrong/different. What I would like is a way to do the lookup similar to 'grep -i' (i.e. case insensitive). Is this possible?

[the_wolverine]

In version 4.1.4, we provide an option to configure lookups to be case insensitive.

Sweet.

[Jason]

Transforms.conf, underneath the stanza defining your lookup, case_sensitive_match = false

[jeff]

That IS sweet!!

[steveyz]

What jrodman said is correct. Currently there is no ability to do case insensitive matching directly. You can either smash case in eval before calling the lookup operator, or use a scripted lookup where obviously you can do whatever type of matching you want.

[jrodman · Accepted solution]

Well, if your lookup is a script, you can of course explicitly smash case. You could also explicitly smash the case in eval. ...|eval host=lower(host) | lookup ...

However given that our text is searched in a case-insensitive fashion, it seems like supporting lookups in an insensitive fashion should be possible, but I don't know if it currently is.

[gkanapathy]

I have a related outstanding question: http://answers.splunk.com/questions/718/how-are-values-in-lookups-matched