Splunk Fundamentals 1 Practice Exam

What is required to search for exact phrases like "best effort"?

1. Parentheses

2. Brackets

3. Quotation marks

4. Asterisk symbol

The correct answer is: Quotation marks

To search for exact phrases in Splunk, the use of quotation marks is essential. When you enclose a phrase in quotation marks, Splunk interprets it as a single entity, meaning it will look for that exact phrase in the indexed data. For example, using "best effort" in a search query will return results that contain that specific sequence of words together. In contrast, parentheses are typically used for grouping terms or controlling the order of operations in a search, which does not apply when seeking out exact matches of phrases. Brackets often serve to define a character class in regex patterns and thus do not facilitate exact phrase searches. The asterisk symbol is utilized for wildcard searches to represent any character or sequence of characters, but it does not confine the search to an exact phrase. Therefore, quotation marks are the correct tool for this task.