How dose the search query works ?

I am using the tag name in search query to filter down the app specific index, followed by "index=index1" to filter down to specific index. tag=app_index index="ïndex1" | stats count by index | dedup index Same as above search query as below brings all the tagged index alone as a result, tag=app_index index=* | stats count by index | dedup index Help me to understand how dose the second case works . As per my understanding index=* will bring all the user specific indexes and main index. Kindly help me on this. Thanks