SPLK-1001 Exam QuestionsBrowse all questions from this exam

SPLK-1001 Exam - Question 112


Field values are case sensitive.

Show Answer
Correct Answer: B

Field values are not case sensitive. This means that 'ABC', 'abc', and 'Abc' would be treated as the same value in searches. In contrast, field names are case sensitive, which means 'sourcetype' and 'Sourcetype' would be considered different fields.

Discussion

6 comments
Sign in to comment
AvahOption: A
Apr 14, 2021

Fields are case sensitive, but the values are not. https://community.splunk.com/t5/Splunk-Search/Ignoring-Case-on-field-values/m-p/107813#:~:text=Splunk%20is%20not%20case%20sensitive%20when%20it%20comes,these%20searches%20would%20all%20return%20the%20same%20results%3A

SecurityPaulOption: B
Jun 12, 2021

Field Names are case sensitive: sourcetype is correct, Sourcetype is incorrect as shown in question 51. Field Values are case insensitive: access_combined, Access_combined and Access_Combined would work equally well.

Splunkie007Option: B
Jun 6, 2023

"The field name is case sensitive, the field value is not case sensitive." https://docs.splunk.com/Documentation/SCS/current/SearchReference/SearchCommandOverview

gigi2909Option: A
Apr 5, 2023

Field values in Splunk are case sensitive by default. Splunk treats "ABC" and "abc" as two distinct values, and they will be stored as such in the index. This means that searches or reports that are case sensitive will only match values that exactly match the case of the search term.

ThoneyOption: B
Apr 7, 2023

Field names are case sensitive field values are not

foxx99Option: B
Apr 20, 2023

Field values are not case sensitive