Splunk Search

Changing default field case sensitivity

bruceclarke
Contributor

All,

I'm wondering if there is a way to change my configuration files to ignore the capitalization of a field. For example, I would want myField and MyField to both show up if my search is something like:

sourcetype="mysource" myField="SomeValue"

I know there are workarounds for this (e.g. rename and evaluating into a new field), but I was wondering if there is any easier way to handle this case. Ideally, I could set this in a conf file.

Thanks!

0 Karma
1 Solution

linu1988
Champion

rsennett_splunk
Splunk Employee
Splunk Employee

There is no facility in Splunk to ignore case sensitivity in field names, since they are meant to be used as labels, like in programming where each label is unique.

You can, however set field aliases in the props.conf file in your sourcetype stanza

FIELDALIAS- = AS

so it would be something like this:
[accesslog]
EXTRACT-extract_ip = (?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})
FIELDALIAS-extract_ip = ip AS ipAddress

You might also want to take a look at this :
http://splunk-base.splunk.com/answers/9201/field-alias-for-all-indexed-data

You haven't said what you're trying to address exactly, but perhaps a combination of the two approaches would spark something for you...

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

linu1988
Champion

Hello,
Similar questions had been answered before. This may help you:

http://splunk-base.splunk.com/answers/59361/dealing-with-keyvalue-pairs-with-inconsistent-key-case

bruceclarke
Contributor

Thanks for the post. I'll give the SED feature a shot.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...