O'Reilly logo

Implementing Splunk: Big Data Reporting and Development for Operational Intelligence by Vincent Bumgarner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Boolean and grouping operators

There are a few operators that you can use to refine your searches (note that these operators must be in uppercase to not be considered search terms):

  • AND is implied between terms. error mary is the same as error AND mary.
  • OR allows you to specify multiple values. error OR mary means "find any event that contains either word".
  • NOT applies to the next term or group. error NOT mary would find events that contain error but do not contain mary.
  • "" identifies a phrase. "Out of this world" will find this exact sequence of words. Out of this world would find any event that contains all of these words, but not necessarily in that order.
  • ( ) is used for grouping terms. Parentheses can help avoid confusion in logic. For instance, ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required