CASE() search option produces no results

[sloshburch]

While using the CASE() feature of the search command (as per http://docs.splunk.com/Documentation/Splunk/6.0.2/Search/Usethesearchcommand#Use_CASE.28.29_and_TERM...) I'm seeing no events produced but there should be.

Example:

earliest=@h-15min latest=@h index=index1 OR index=index2 _raw="*Exception*"

produces results.

earliest=@h-15min latest=@h index=index1 OR index=index2 CASE(Exception)

produces NO results.

This seems to ONLY happen while using the string "Exception". Other strings within the CASE() function are working as expected.

This is on Splunk 6.0.2.

Anyone seen this before?

[sloshburch]

See somesoni2's comment for the answer to this question.

[sloshburch]

Thank you somesoni2 - I didn't realize it had that complete-word restriction. I also thought I had previously tried wildcards with no luck. I now see wildcards work.

Thanks everyone!

[somesoni2 · Accepted solution]

Or use CASE(*Exception*). this will work same as _raw="*Exception*", just it will be case-sensitive.

[lukejadamec]

You might try TypeOfException

[lukejadamec]

That is not going to work with case. Read the bottom of the link you posted to see why. Or - what somesoni2 said.

[sloshburch]

It's found preceded by letters org.something.somethingelse.somethingother.TypeOfException ending with a space or a :

[somesoni2]

In my understanding, CASE does case-sensitive match for the a term/field values, which means it does a match for a complete word. So CASE(Exception) will match 'Exception' or 'Test.Exception.foo' but not 'OracleException' . _raw="Exception" will match a portion of a term as well hence you're getting results there. Check if Exception is a complete word/term in your logs.

[lukejadamec]

Is Exception surrounded by major breakers?