Just want to clear this up so I am not mistaken. Are the two statements equivalent:
| where like (foo, "bar")
| where foo LIKE "bar"
In my test setup I am getting the same search results, I'm wondering if there is anything different on the backend that Splunk does. From the Job inspector it seems they both run the same Optimized search of the first option. Should this be the preferred syntax?