Exam SPLK-1001 All QuestionsBrowse all questions from this exam
Question 112

Field values are case sensitive.

    Correct Answer: B

    Field values are not case sensitive. This means that 'ABC', 'abc', and 'Abc' would be treated as the same value in searches. In contrast, field names are case sensitive, which means 'sourcetype' and 'Sourcetype' would be considered different fields.

Discussion
Splunkie007Option: B

"The field name is case sensitive, the field value is not case sensitive." https://docs.splunk.com/Documentation/SCS/current/SearchReference/SearchCommandOverview

SecurityPaulOption: B

Field Names are case sensitive: sourcetype is correct, Sourcetype is incorrect as shown in question 51. Field Values are case insensitive: access_combined, Access_combined and Access_Combined would work equally well.

AvahOption: A

Fields are case sensitive, but the values are not. https://community.splunk.com/t5/Splunk-Search/Ignoring-Case-on-field-values/m-p/107813#:~:text=Splunk%20is%20not%20case%20sensitive%20when%20it%20comes,these%20searches%20would%20all%20return%20the%20same%20results%3A

foxx99Option: B

Field values are not case sensitive

ThoneyOption: B

Field names are case sensitive field values are not

gigi2909Option: A

Field values in Splunk are case sensitive by default. Splunk treats "ABC" and "abc" as two distinct values, and they will be stored as such in the index. This means that searches or reports that are case sensitive will only match values that exactly match the case of the search term.