Splunk Enterprise

where command clarificaion

ips_mandar
Builder

I was working with where command like below-

 

index=abc|where (id=1ORid=2ORid=3)

 

In between  id field I have used OR operator and by mistake I haven't used space before and after OR. 
still I get same results like below query results.

 

index=abc|where (id=1 OR id=2 OR id=3)

 

so does it not matter to have space before and after OR operator?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Experience is the best teacher.  If it works and produces the correct results then using spaces is not required, but is a good idea so the query is easier to read.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Experience is the best teacher.  If it works and produces the correct results then using spaces is not required, but is a good idea so the query is easier to read.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...