Multiple where clauses vs. 'and' in kusto

user_3680190 0
Viewed 349

In terms of performance, is the following query

ResourceEvents
| where ResourceType == "Foo" and EventType == "Bar"

practically the same as

ResourceEvents
| where ResourceType == "Foo"
| where EventType == "Bar"

Or are the records filtered sequentially, performing two searches instead of one combined?

kql azure-data-explorer
2 Answers

both options are equivalent in terms of semantics and performance

user_78618070

Adding to Yoni's answer, you can check it yourself by looking at the query plan.

.show queryplan  <|
StormEvents
| where State == "TEXAS" and EventType == "Flood"


.show queryplan  <|
StormEvents
| where State == "TEXAS" 
| where EventType == "Flood"

The plans are equivalent.

user_72528050
Related