Why splunk do not scan all events to search a specific keyword?

[Bhagyashri]

Suppose I have 1 Lac events with sourcetype = java and i am searching for keyword "xyz" with query: sourcetype=java xyz
I think search should scan all 1 Lac events and then return should matched events.
But it just scanning 12,457 events and returning 202 matched events.
why this so?
is it means splunk not searching that keyword into all 1 lac files?

[martin_mueller · Accepted solution]

Splunk is searching all 1 Lakh of events, but knows it doesn't need to look at 87633 of them because they can't contain the keyword. There are smart index structures created when the data is read into Splunk to speed up searching, a low scan count is a good sign of that.
If Splunk did scan all events your search would be much much slower.