Boolean operators

There are three different types of Boolean operators available in Splunk. These are AND, OR, and NOT. Case sensitivity is important here, and these operators must be in uppercase to be recognized by Splunk. The AND operator is implied by default and is not needed, but does no harm if used.

For example, searching for error OR success would return all events that contain either the word error or the word success. Searching for error success would return all events that contain the words error and success. Another way to write this would be error AND success. Searching web access logs for error OR success NOT mozilla would return all events that contain either the word error or success, but not those events that might also contain the word mozilla.