Splunk SPLK-1001 Question Answer
What is the proper SPL terminology for specifying a particular index in a search?
indexer—index_name
indexer name—index_name
index=index_name
index name=index_name
This means that you can use the index field to filter your search results by the name of the index that contains the events you want to see.
For example, if you want to search for events in the index named “gcp_logs”, you can use the following SPL:
index=gcp_logs
You can also specify multiple indexes by using the OR operator, such as:
index=gcp_logs OR index=oswin
TESTED 11 Jul 2025
Copyright © 2014-2025 ACE4Sure. All Rights Reserved