Splunk Search

Is using TERM() the same as searching for something in quotes?

splunkin11
Path Finder

Is using TERM() the same as searching for something in quotes, in that the search is not checking letter by letter, but rather the entire string?

0 Karma
1 Solution

sundareshr
Legend

Here's some good documentation on this.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Usethesearchcommand#Use_CASE.28.29_and_TERM...

TERM() operator treatS whatever is inside the parenthesis as a single term in the index.

View solution in original post

sundareshr
Legend

Here's some good documentation on this.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Usethesearchcommand#Use_CASE.28.29_and_TERM...

TERM() operator treatS whatever is inside the parenthesis as a single term in the index.

Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...