Which syntax will find events where the values for the 1 field match the values for the Renewal- MonthYear field?

The correct answer is D. | where `10yearAnnerversary'='Renewal-MonthYear'. In Splunk's where command, field names that begin with a number (like 10yearAnnerversary) must be enclosed in backticks to be interpreted as field names rather than numeric literals. Field names containing hyphens (like Renewal-MonthYear) must be enclosed in single quotes in…

Filtering and Grouping Results

Question

Options

A| where 10yearAnnerversary=Renewal-MonthYear
B| where `10yearAnnerversary=Renewal-MonthYear
C| where 10yearAnnerversary='Renewal-MonthYear'
D| where `10yearAnnerversary'='Renewal-MonthYear'

How the community answered

(24 responses)

B
4% (1)
C
4% (1)
D
92% (22)

Explanation

In Splunk's where command, field names that begin with a number (like 10yearAnnerversary) must be enclosed in backticks to be interpreted as field names rather than numeric literals. Field names containing hyphens (like Renewal-MonthYear) must be enclosed in single quotes in the where clause, as the hyphen would otherwise be interpreted as a subtraction operator. Option D correctly applies backticks to the first field and single quotes to the second, making it the only syntactically valid comparison between two fields.

Topics

#Splunk SPL#`where` command#Field comparison#Syntax

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice