KQL performance of WHERE condition

Viewed 153

Is there any difference in KQL in performance between joining WHERE conditions using ADD statements or adding them separately?

Will smth like

Events
| where Source == "myapp"
and Timestamp > ago(7d)
and isnotnull(DeviceId)
and isnotnull(UserId)

be faster than

Events
| where Source == "myapp"
| where Timestamp > ago(7d)
| where isnotnull(DeviceId)
| where isnotnull(UserId)

?

2 Answers

No difference whatsoever. Both queries are equivalent.

According to the docs, you should use a time filter first because Kusto is highly optimized to use time filters.

Related