The double colon :: refers to an indexed field so if the field is NOT indexed, it will not find it.
If you run this search
index=_audit sourcetype=audittrail
| stats count by sourcetype
and then insect the job and look at the search log, you will see something called LISPY
09-29-2023 10:26:38.508 INFO UnifiedSearch [3846 searchOrchestrator] - base lispy: [ AND index::_audit sourcetype::audittrail ]
where is knows that index and sourcetype are indexed fields and so replaces them with the :: syntax.
So, if you KNOW your field is indexed, then using :: will force Splunk to look at the indexed rather than raw data for the results.
