search using conditional operators are case sensitive

[cpt12tech]

This search will not work:
index=mail and (scriptName=ACF or scriptName=ACE)

This search will work:
index=mail AND (scriptName=ACF OR scriptName=ACE)

[stephanefotso]

That is true. AND is not and. But i thing here you don't need to use the AND because index=mail (scriptName=ACF OR scriptName=ACE) is the same with index=mail AND (scriptName=ACF OR scriptName=ACE)

Also, when you say index=mail and (scriptName=ACF OR scriptName=ACE), this match all events where index= mail and that events must have the word and and then the sourcetype must be ACF or the scriptNAME must be ACE

But when you say index=mail (scriptName=ACF OR scriptName=ACE), this match all events where the index= mail, and sourcetype= ACF or sriptName=ACF

Thanks