why do matchesValue and matchesPhrase give different results in this case?

[GerryIsHere]

Here are two queries, I don't understand why the results are different (same time period 24 hours):

fetch logs
| filter matchesPhrase(host.name, "tar04*")
| summarize collectDistinct(host.name)

tar045.dcmax.local
tar046.dcmax.local

fetch logs
| filter matchesValue(host.name, "tar04*")
| summarize collectDistinct(host.name)

tar040.dcmax.local
tar041.dcmax.local
tar045.dcmax.local
tar046.dcmax.local

[cesarsaravia · Accepted solution]

Hi @GerryIsHere 
The only difference between those functions are the validations that matchesPhrase realizes.

Tried to replicate your scenario with the same data, and in both cases the result is the same.

Could you get us more context?
Regards,

[GerryIsHere]

the logs are from WebLogic servers, I think there is 1-2 million logs a day. If I run the queries just counting the number of logs matchesPhrase finds way fewer logs. The host.names are exactly as shown.

[GerryIsHere]

doesn't support mid-string wildcards, except some of the time when it does apparently!