Splunk Search

Does the`search` command has implicit AND between expressions?

davidch12
Explorer

I always understood the search command's expressions be connected by a logical AND by default:
search customer=123 item=flower will return events that have both customer=123 AND item=flower.

However, I was looking at the Search Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Search
Under Syntax, I see this excerpt:
<logical-expression> [OR] <logical-expression>

This reads to me like [OR] is optional and means the same without [OR] with a space separator, so I interpret it as:
<logical-expression> [OR] <logical-expression> is equivalent to <logical-expression> <logical-expression>

Am I not understanding this syntax in Reference correctly?

0 Karma

FrankVl
Ultra Champion

I think you're indeed misinterpreting that syntax. When no operator is specified, AND is implied. I do agree that this can be a little confusing. You might want to post that as a feedback at the bottom of the docs page, such that the author of that page can perhaps clarify that.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...