@ak1508 as per color coding for SPL post Splunk 6.5 , the like in the command | where foo like "bar" is an argument as it highlights as orange, but using | where like(foo,"bar") treats it as function and highlights as pink. Refer to Splunk Documentation for the same: https://docs.splunk.com/Documentation/Splunk/latest/Search/Parsingsearches#Color_codes
You should be using the second one because internally Splunk's Query Optimization converts the same to function like() .
Which implies following query in Splunk Search
| makeresults
| eval data="testabc"
| where data like "test%"
Converts to the following optimized query when it executes (you can check Job Inspector for details:
| makeresults
| eval data="testabc"
| where like(data,"test%")
... View more
