How does this search work?

[jnithya]

I am using the tag name in search query to filter down the app specific index, followed by "index=index1" to filter down to specific index.

tag=app_index index="ïndex1" | stats count by index  | dedup index

Same as above search query as below brings all the tagged index alone as a result,

tag=app_index index=* | stats count by index  | dedup index

Help me to understand how does the second case works . As per my understanding index=* will bring all the user specific indexes and main index.

Kindly help me on this.

Thanks

[cmerriman · Accepted solution]

index=* will bring back all indexes. I would avoid using the wildcard, unless you have some index field values that are null that you are trying to weed out, as it takes more time to process. So tag=app_index index=* would essentially be the same as tag=app_index