Search code examples
azure-data-explorerkql

Multiple where clauses vs. 'and' in kusto


In terms of performance, is the following query

ResourceEvents
| where ResourceType == "Foo" and EventType == "Bar"

practically the same as

ResourceEvents
| where ResourceType == "Foo"
| where EventType == "Bar"

Or are the records filtered sequentially, performing two searches instead of one combined?


Solution

  • both options are equivalent in terms of semantics and performance