On Sat, Sep 23, 2017 at 4:08 PM, <reddyansh...@gmail.com> wrote: > Q1) Is the following searches will return the same results. SEARCH 1: ssh > error SEARCH 2: ssh AND error. True or False
I think splunk's default search is an "OR," but it's been a while (and of course my local install is acting up at the moment). > Q2) Is the following searches will not return the same results. SEARCH 1: > purchase SEARCH 2: action=purchase . True or False > Hard to tell. If there are instances with the word "purchase" not in the action field, those will return with the first search, but not the second. > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
