Getting Data In

Are sourcetype names case-sensitive?

Justin_Grant
Contributor

Yet another case-sensitivity question: are sourcetype names case-sensitive?

Labels (1)
0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

In search, no they are not. Note that this is very similar to the more general question:

http://answers.splunk.com/questions/65/are-field-values-case-sensitive

See my answer there. I go into a little more detail there which you might find interesting.

View solution in original post

anwarmian
Communicator

sourcetype in props.conf in case-senstive

[MySourcetype] is different from [mysourcetype]
From Splunk Documentation (pros.conf)

By default, [source::<source>] and [<sourcetype>] stanzas match in a
case-sensitive manner, while [host::<host>] stanzas match in a
case-insensitive manner. This is a convenient default, given that DNS names
are case-insensitive.



0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Well...in props.conf I think they will be (unless you express the stanza like: [::(?i)mYSourCeTypeName]. In thesearchcommand (which is implicit at the start of a query) they won't be, but forwherecomparisons in search queries,stats` values, etc., they will be.

It's not whether the names themselves are case-sensitive. It's whether whatever you're doing at the time is sensitive to the case of the names. It's more accurate to say that Splunk is case-sensitive in most places where you'd use a sourcetype name, and that the search command is actually an exception.

0 Karma

sideview
SplunkTrust
SplunkTrust

In search, no they are not. Note that this is very similar to the more general question:

http://answers.splunk.com/questions/65/are-field-values-case-sensitive

See my answer there. I go into a little more detail there which you might find interesting.

CerielTjuh
Path Finder

You can try this yourself 🙂

sourcetype="wineventlog:security"

instead of

sourcetype="WinEventLog:Security"

both work, so I'm assuming its not case sensitive

Zaphod
Engager

This is not my experience.

index=* sourcetype=Xmlwineventlog | stats count by sourcetype

returns stats for sourcetype XmlWinEventLog

index=* sourcetype=xmlwineventlog | stats count by sourcetype

returns stats for sourcetype XmlWinEventLog and sourcetype xmlwineventlog.

agneticdk
Path Finder

I agree on the XmlWinEventLog vs xmlwineventlog. Splunk has something here that is not "normal" behavior.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...