Splunk Search

Are field values case sensitive?

araitz
Splunk Employee
Splunk Employee

Are field values case sensitive? Is this behavior the same in 3.x and 4.x versions of Splunk?

1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

each search operator is allowed to treat field value case sensitivity as it sees fit.

search is case insensitive 
stats is case sensitive 
sort is case sensitive

View solution in original post

khodges_splunk
Splunk Employee
Splunk Employee

Also, by default, values in lookup tables are case sensitive but you can change them to be case insensitive in transforms.conf.

Check out transforms.conf.spec in $SPLUNK_HOME/etc/system/README

case_sensitive_match =
* If set to false, case insensitive matching will be performed for all fields in a lookup
table
* Defaults to true (case sensitive matching)

sideview
SplunkTrust
SplunkTrust

Field values are not case sensitive. When searching for plain text tokens like foo, and phrase searches like "foo bar", these are are not case sensitive either.

On the other hand field names are always case sensitive, in the search command and in other commands.

eg if you have a field extracted as 'myfield', searching for myfield="bar" will work, whereas myField="bar" will not.

As far as other commands besides search, arguments and values are generally case sensitive and my advice is to assume that they are until proven otherwise.

I believe this picture was the same back in 3.X but im not positive.

Ledion_Bitincka
Splunk Employee
Splunk Employee

each search operator is allowed to treat field value case sensitivity as it sees fit.

search is case insensitive 
stats is case sensitive 
sort is case sensitive
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...