Well, that is only true if "test" and "hello" are not individual tokens.
I.E. If I search as follows:
index=X test hello @ | rex email="test.*hello@.*"
This will NOT return any results IF the data you are looking for is something like
"testworldhello@something.com"
This is because you cannot search for "test" or "hello" on their own if they are just a part of a larger token (testworldhello).
The search above WILL return results if the data looks like:
"test.world-hello@something.com"
The main point I am trying to make is that to create better search efficiency you can provide as many actual tokens as you can, up front. Tokens are separated by things like dots, dashes, slashes, etc.
To see how tokens are identified and separated in Splunk you can research segmenters.conf which shows you how Splunk breaks out tokens in any event.
... View more