Hi there, To answer your question, the use of paranthesis doesn't affect the performance of your splunk query. But on the other hand using a "=" instead of the "IN" function will help you; as IN is a function call and splunk processor will always first go to the function definition decode the function then resume the search query. ... View more