Splunk Search

eventtype=A eventtype=B is this an OR or an AND?

gerrysr6
Explorer

As I understand the documentation ANDs are implied, so "eventtype=A eventtype=B"  is the same as "eventtype=A AND eventtype=B" 

Also, if the tag names are the same like in this case it is interpreted as "eventtype=A OR eventtype=B".

So my question is "eventtype" a tag name or not? If I do a search the search results say eventtype is both A and B! I don't understand.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is AND - which documentation are you referring to?

0 Karma
Get Updates on the Splunk Community!

Holistic Visibility and Effective Alerting Across IT and OT Assets

Instead of effective and unified solutions, they’re left with tool fatigue, disjointed alerts and siloed ...

SOC Modernization: How Automation and Splunk SOAR are Shaping the Next-Gen Security ...

Security automation is no longer a luxury but a necessity. Join us to learn how Splunk ES and SOAR empower ...

Ask It, Fix It: Faster Investigations with AI Assistant in Observability Cloud

  Join us in this Tech Talk and learn about the recently launched AI Assistant in Observability Cloud. With ...