How to make Splunk query case sensitive

Question

How do I make my query case sensitive.

Say I want my search results for "Case Sensitive" and not "CASE sensitive" or "CASE SENSITIVE"

This is what I'm using which isn't helping.

index=foo_foo sourcetype=foo "Is my query CASE(Case Sensitive)"

I've tried using CASE(Case Sensitive) but that didn't help me get the results.

score 3 · Accepted Answer · answered Dec 14 '17 at 15:04

3

I suspect Splunk is interpreting your search string literally so is not seeing CASE as a function.

Try this:

index=foo_foo sourcetype=foo "Is my query "CASE(Case Sensitive)

answered Dec 14 '17 at 15:04

Tim

1 Answers1