What are the expected results for a search that contains the command | where A=B?

Question

Options

• AEvents that contain the string value where A=B.
• BEvents that contain the string value A=B.
• CEvents where values of field are equal to values of field B.
• DEvents where field A contains the string value B.

• A
  2% (1)
• B
  2% (1)
• C
  90% (37)
• D
  5% (2)

Explanation

The where command in Splunk evaluates Boolean expressions and keeps only events where the expression is true. Unlike the main search bar where field=value treats the right side as a string literal, in the where command A=B treats both A and B as field names and compares their values. So | where A=B returns events where the value of field A equals the value of field B. To compare a field to a string literal in the where command, you would need quotes: | where A="B".

No community discussion yet for this question.