Does defining an eventtype improve performance?

[BradL]

Is there a performance difference between searching for this:

index=foo host=XXXX "a text string bar"

vs.
defining an eventtype bar_event:

index=foo "a text string bar"

and then searching for this:

index=foo host=XXXX eventtype=bar_event

?

I'm wondering if the eventtype definition causes the generation of any additional indexing data to speed up the search.

[chanfoli · Accepted solution]

I do not believe so since eventtypes are just replacing regular search language, but hey, did you know that you can always use the job inspector to check into such things with your own searches and data? It is a pretty cool tool.