Splunk Search

search using conditional operators are case sensitive


This search will not work:
index=mail and (scriptName=ACF or scriptName=ACE)

This search will work:
index=mail AND (scriptName=ACF OR scriptName=ACE)

0 Karma


That is true. AND is not and. But i thing here you don't need to use the AND because index=mail (scriptName=ACF OR scriptName=ACE) is the same with index=mail AND (scriptName=ACF OR scriptName=ACE)

Also, when you say index=mail and (scriptName=ACF OR scriptName=ACE), this match all events where index= mail and that events must have the word and and then the sourcetype must be ACF or the scriptNAME must be ACE

But when you say index=mail (scriptName=ACF OR scriptName=ACE), this match all events where the index= mail, and sourcetype= ACF or sriptName=ACF


0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!