Splunk searching questions

Question

1. Will the following searches return the same results?

   SEARCH 1: ssh error
   SEARCH 2: ssh AND error

2. Will the following searches not return the same results?

   SEARCH 1: purchase
   SEARCH 2: action=purchase

Answer 1

In SPL, the terms of an initial search are each treated as limitations on the search (i.e. ANDs).

Thus, these two searches are identical...

"foo" "bar" 
"foo" AND "bar"

In SPL, logical operators must be upper case. Thus, these two searches are NOT identical...

"foo" AND "bar"
"foo" and "bar"

...but these two are identical...

"foo" AND and AND "bar"
"foo" and "bar"

In SPL, a search term by itself will return every event that contains the term in any field, whereas a key value pair will return only the events that contain that term in that field.

Thus, these two searches are NOT identical, but might return the same result if "foo" (A) never occurred in any field, or (B) only occurred as a value in the field bar.

"foo"
bar="foo"

Answer 2

1. Yes, AND is implied..

2. They will NOT return the same searches. An example includes an event having "The user did not purchase this item" vs action=purchase which means the user purchased the item