Does sequence matter in search?

[Pathik]

Does sequence matter in search? from below 2 queries, which is recommended or both will perform with same performance?

Query1:

index=myindex AND "mystring" AND host=myprodhost*

Query2:

index=myindex AND host=myprodhost* AND "mystring" 

[Pathik]

@gcusello  thanks, so splunk would find best optimum fields to search first and then proceed with others... thanks

[gcusello · Accepted solution]

Hi @Pathik,

it's absolutely the same!

and you don't need to use the "AND" operator.

Ciao.

Giuseppe

[gcusello]

Hi @Pathik,

the search algorithm of Splunk choose the most efficient combination of fields.

Ciao and good splunking.

Giuseppe

P.S. Karma Points are appreciated 😉