Splunk Core Certified User — Question 71

When writing searches in Splunk, which of the following is true about Booleans?

Answer options

• A. They must be lowercase.
• B. They must be uppercase.
• C. They must be in quotations.
• D. They must be in parentheses.

Correct answer: B

Explanation

In Splunk, Boolean operators such as AND, OR, and NOT must be written in uppercase to be recognized correctly. The other options are incorrect because lowercase Booleans, quotations, and parentheses do not conform to the required syntax for these operators in Splunk searches.