About Rob1971

Rob1971

All lab exercises are working fine, it's just something I discovered when trying things myself. I wondered why the two beneath searches give different results. index=network | where x_wbrs_score < 4 index=network | search x_wbrs_score < 4 When using "search" strings are included (although Splunk defines the field as a number), with "where" not.

Rob1971

Thanks for your replies. This concerns the x_wbrs_score field (index=network) in the Comparing Values training.

Rob1971

Hello, I have a field that is specified in the interesting fields as numeric (a). However, this field has numeric and string values. When I filter with "where" Splunk only returns numeric values. When I use "search" Splunk also returns the string values. I ahve two questions about this: -why does Splunk specify the field as numeric, while it also contains string values? -why does "where" only return numeric values and "search" numeric and string values of the field. Thanks, Rob

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎09-14-2026

Online Status	Offline
Date Last Visited	a month ago

Different output search and where

Re: Different output search and where

Re: Different output search and where

Different output search and where

Join the Conversation

Different output search and where

Re: Different output search and where

Re: Different output search and where

Different output search and where