About keyword search

Splunk does not distinguish between uppercase and lowercase letters when searching for keywords.

For example, if you search for the keyword "error", the search results will include not only data that contains the keyword "error" in lowercase, but also data that contains keywords such as ERROR and Error.

About CASE()

To perform a case-sensitive search, use CASE().

For example, if you perform a search like CASE(error), only data containing the keyword error in lowercase will be output as search results, and data containing keywords such as ERROR or Error will not be output in the search results.

Also, using CASE() may result in slower search speeds than not using it.