# SPLK-1001 — Question 602

**Type:** multiple_choice
**Topics:** topic_1

## Question

Which search string only returns events from hostWWW3?

## Correct Answer

_See scenario._

## Explanation

A. Will returns multiple field values from host field.
C. Will return multiple field values starting with "WWW "
D. will return nothing, as field name is case sensitive.
Therefore, B is correct. field name fit metadata field name, and field value is specific.

**Reference:** examtopics_top_comment

---
Source: https://hiexam.net/q/splunk/SPLK-1001/602  
Practice (tracked): https://hiexam.net/study/SPLK-1001/practice