Hi, We are using both Splunk Cloud and Splunk Enterprise. We recently came across some issues/differences in search we originally thought were due to indexed field issues but turned out to be more about some basic difference in how each environment converts a search into lispy (at least that is what we observe). For example in Splunk Cloud 8.2.2203.4 the following search:   index=_internal some_field=some-value   Results in the following lispy:   [ AND index::_internal [ OR some_field::some-value [ AND some value ] ] ]     For our Splunk Enterprise 8.2.6 the same search results in the following lispy:   [ AND index::_internal some value ]     In our case `some_field` is an index field added on by our HEC requests. This results in very incorrect searches in enterprise and inefficient searches in cloud. We do now realize we can just directly query for "some_field::some_value" but we would like to understand this behavior difference and if it is configurable.   Thanks ... View more