https://community.splunk.com/t5/Splunk-Search/what-are-the-benefits-vs-drawback-in-and/m-p/659009#M227595 <P>whats the difference between :: and = in splunk search. what are the benefits vs drawbacks</P> Thu, 28 Sep 2023 19:57:06 GMT noorani1980 2023-09-28T19:57:06Z https://community.splunk.com/t5/Splunk-Search/what-are-the-benefits-vs-drawback-in-and/m-p/659009#M227595 <P>whats the difference between :: and = in splunk search. what are the benefits vs drawbacks</P> Thu, 28 Sep 2023 19:57:06 GMT https://community.splunk.com/t5/Splunk-Search/what-are-the-benefits-vs-drawback-in-and/m-p/659009#M227595 noorani1980 2023-09-28T19:57:06Z https://community.splunk.com/t5/Splunk-Search/what-are-the-benefits-vs-drawback-in-and/m-p/659022#M227602 <P>The double colon :: refers to an indexed field so if the field is NOT indexed, it will not find it.&nbsp;</P><P>If you run this search</P><LI-CODE lang="markup">index=_audit sourcetype=audittrail | stats count by sourcetype</LI-CODE><P>and then insect the job and look at the search log, you will see something called LISPY</P><LI-CODE lang="markup">09-29-2023 10:26:38.508 INFO UnifiedSearch [3846 searchOrchestrator] - base lispy: [ AND index::_audit sourcetype::audittrail ]</LI-CODE><P>where is knows that index and sourcetype are indexed fields and so replaces them with the :: syntax.</P><P>So, if you KNOW your field is indexed, then using :: will force Splunk to look at the indexed rather than raw data for the results.</P><P>&nbsp;</P> Fri, 29 Sep 2023 00:29:49 GMT https://community.splunk.com/t5/Splunk-Search/what-are-the-benefits-vs-drawback-in-and/m-p/659022#M227602 bowesmana 2023-09-29T00:29:49Z