Splunk Search

search using conditional operators are case sensitive

Contributor

This search will not work:
index=mail and (scriptName=ACF or scriptName=ACE)

This search will work:
index=mail AND (scriptName=ACF OR scriptName=ACE)

0 Karma

Motivator

That is true. AND is not and. But i thing here you don't need to use the AND because index=mail (scriptName=ACF OR scriptName=ACE) is the same with index=mail AND (scriptName=ACF OR scriptName=ACE)

Also, when you say index=mail and (scriptName=ACF OR scriptName=ACE), this match all events where index= mail and that events must have the word and and then the sourcetype must be ACF or the scriptNAME must be ACE

But when you say index=mail (scriptName=ACF OR scriptName=ACE), this match all events where the index= mail, and sourcetype= ACF or sriptName=ACF

Thanks

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!