Let's say I have a lookup table that looks like this:
host,tmoapp somehost01,app01 somehost02,app01 anotherhost01,app02 anotherhost02,app02 ...
The issue is when a host field comes in from the agent as (say) 'SOMEHOST02'... That hostname will not get its tmoapp field correctly populated because the hostname case is wrong/different. What I would like is a way to do the lookup similar to 'grep -i' (i.e. case insensitive). Is this possible?
Well, if your lookup is a script, you can of course explicitly smash case. You could also explicitly smash the case in eval. ...|eval host=lower(host) | lookup ...
However given that our text is searched in a case-insensitive fashion, it seems like supporting lookups in an insensitive fashion should be possible, but I don't know if it currently is.
In version 4.1.4, we provide an option to configure lookups to be case insensitive.
Sweet.
Transforms.conf, underneath the stanza defining your lookup, case_sensitive_match = false
That IS sweet!!
What jrodman said is correct. Currently there is no ability to do case insensitive matching directly. You can either smash case in eval before calling the lookup operator, or use a scripted lookup where obviously you can do whatever type of matching you want.
Well, if your lookup is a script, you can of course explicitly smash case. You could also explicitly smash the case in eval. ...|eval host=lower(host) | lookup ...
However given that our text is searched in a case-insensitive fashion, it seems like supporting lookups in an insensitive fashion should be possible, but I don't know if it currently is.
I have a related outstanding question: http://answers.splunk.com/questions/718/how-are-values-in-lookups-matched