nerdexam
Splunk

SPLK-1001 · Question #67

Which of the following statements about case sensitivity is true?

The correct answer is B. Field names ARE case sensitive; field values are NOT. Option B is correct because in this system, field names must match exactly in their capitalization - using Host when the field is defined as host will fail to match - while field values are treated without regard to case, so searching for a value of Error, error, or ERROR will…

Question

Which of the following statements about case sensitivity is true?

Options

  • ABoth field names and field values ARE case sensitive.
  • BField names ARE case sensitive; field values are NOT.
  • CField values ARE case sensitive; field names ARE NOT.
  • DBoth field names and field values ARE NOT case sensitive.

How the community answered

(26 responses)
  • A
    15% (4)
  • B
    73% (19)
  • C
    4% (1)
  • D
    8% (2)

Explanation

Option B is correct because in this system, field names must match exactly in their capitalization - using Host when the field is defined as host will fail to match - while field values are treated without regard to case, so searching for a value of Error, error, or ERROR will all return the same results. This asymmetry exists by design: field names are structural identifiers that the system indexes precisely, whereas value matching is made flexible to reduce user error during queries.

Why the distractors are wrong:

  • A is wrong because field values are not case sensitive, only names are.
  • C flips the rule - it has the two reversed.
  • D is wrong because field names are definitely case sensitive.

Memory tip: Think "Names are Strict, Values are Slack" - field Names require exact case (like a variable name in code), while Values are forgiving (like a search engine query).

Community Discussion

No community discussion yet for this question.

Full SPLK-1001 Practice