Which syntax will find events where the values for the 1 field match the values for the Renewal- MonthYear field?

In Splunk's Search Processing Language, the where command evaluates expressions. When a field name starts with a digit (like 10yearAnnerversary) or contains a hyphen (like Renewal-MonthYear), it is not considered a "standard" identifier. To ensure the evaluation engine treats these strings as field names rather than numbers or mathematical operations (e.g., subtraction in Renewal - MonthYear), they must be enclosed in single quotes. Option D correctly identifies that both fields require single quotes to be compared against each other logically. Double quotes would instead treat the strings as literal text values, which would fail the comparison.

Option A: This fails because the parser will attempt to treat 10yearAnnerversary as a number/invalid token and interpret the hyphen in Renewal-MonthYear as a subtraction operator.

Option B: This syntax is malformed. It uses a leading single quote but fails to close it correctly and does not account for the hyphenated field name on the right.

Option C: While it correctly quotes the hyphenated field, it fails to quote 10yearAnnerversary. Because that field starts with a number, the where command will fail to recognize it as a valid field name.

Splunk Documentation: Search Reference, "where command," Section: "Usage." (States that field names containing non-alphanumeric characters must be enclosed in single quotes).

Splunk Documentation: Search Manual, "Identify fields with non-alphanumeric characters." (Provides rules for escaping field names in SPL).

Splunk Education: Splunk Power User Courseware, Module: "Using the where command," Section: "Comparing Fields."

Splunk Documentation: Search Reference, "Common Information Model (CIM) Compliance," Section: "Field Naming Conventions."