Splunk Search
Highlighted

Is using TERM() the same as searching for something in quotes?

Path Finder

Is using TERM() the same as searching for something in quotes, in that the search is not checking letter by letter, but rather the entire string?

0 Karma
Highlighted

Re: Is using TERM() the same as searching for something in quotes?

Legend

Here's some good documentation on this.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Usethesearchcommand#Use_CASE.28.29_and_TERM...

TERM() operator treatS whatever is inside the parenthesis as a single term in the index.

View solution in original post