Which Field/Value pair will return only events found in the index named security?

Question

Options

• AIndex=Security
• Bindex=Security
• CIndex=security
• Dindex!=Security

• A
  2% (1)
• B
  81% (43)
• C
  11% (6)
• D
  6% (3)

Explanation

Option B (index=Security) is correct because Splunk's search language is case-sensitive for field names - index must be lowercase - while index values are case-insensitive, meaning Security and security would both match the same index.

Why the distractors fail:

• A (Index=Security) - wrong because Index (capital I) is not a recognized Splunk field; Splunk will ignore or misinterpret it.
• C (Index=security) - same problem as A: the capital I in Index breaks the field reference entirely, regardless of the value casing.
• D (index!=Security) - the != operator means "not equal to," so this returns events from every index except security - the opposite of what's asked.

Memory tip: Think of it as "the field is your key, so keep it lowercase and exact - Splunk won't find the lock otherwise." A reliable mnemonic: "small index, any case value" - field name index is always lowercase, but the value (security, Security, SECURITY) is flexible.

No community discussion yet for this question.