Boolean and Comparison Operators

Simple explanation

Precisely controlling which events match your search comes down to a small set of operators — this lesson covers all of them.

Technical explanation

AND — implied between adjacent terms with no operator; must be written in UPPERCASE to be recognized as an operator rather than a literal search term.
OR — matches events containing either term; also must be uppercase.
NOT — excludes events matching the following term; excludes events where the field exists with a different value AND events where the field doesn't exist at all.
!= — a comparison operator specifically for field values; behaves differently from NOT — field!=value only returns events where the field EXISTS but has a different value, excluding events where the field is entirely absent (the opposite nuance from NOT).
Comparison operators: =, !=, >, <, >=, <= — used for both string and numeric field comparisons.
Parentheses — group conditions to control evaluation order, essential once combining AND/OR in the same search ((index=netfw failure) OR (index=netops (warn OR critical))).
Wildcards (*) — match any characters within a term or field value.

Synonyms / related terms

| Term | Means | |---|---| | Boolean operator | AND, OR, NOT specifically | | Comparison operator | =, !=, >, <, >=, <= |

Concept Check

"A search uses status != 200 and is expected to return every event where status isn't 200, including events that have no status field at all." This is a common misconception — != only returns events where the field EXISTS with a different value; events missing the status field entirely are excluded. To also catch events missing the field, NOT status=200 is needed instead, since NOT's exclusion behavior includes the missing-field case.

Interview-style Q&A

Q: Why must Boolean operators be written in uppercase? A: "Lowercase 'and'/'or' are treated as literal search terms, not operators — Splunk would search for events literally containing the word 'and', not use it to combine two conditions. Requiring uppercase is what disambiguates the operator meaning from a legitimate search term that happens to share the same word."

Memory trick

"NOT excludes broadly, != excludes narrowly" — the single most commonly tested distinction in this whole lesson, condensed to one line.