https://community.splunk.com/t5/Monitoring-Splunk/Which-is-more-efficient-filldown-or-streamstats/m-p/269740#M2552 <P>Run both searches on your system searching your events over the same time range and check the job inspector for each search and you will get the answer which one will perform best for you in your environment.</P> Thu, 10 Dec 2015 20:14:09 GMT MuS 2015-12-10T20:14:09Z https://community.splunk.com/t5/Monitoring-Splunk/Which-is-more-efficient-filldown-or-streamstats/m-p/269739#M2551 <PRE><CODE>... | sort _time | filldown l_lat l_lon by UID | table _time UID w_tbys w_tbyr l_lat l_lon </CODE></PRE> <P>or</P> <PRE><CODE>... | sort _time | streamstats last(l_lat) as lastLat last(l_lon) as lastLon by UID | table _time UID w_tbys w_tbyr l_lat lastLat l_lon lastLon </CODE></PRE> Thu, 10 Dec 2015 20:08:41 GMT https://community.splunk.com/t5/Monitoring-Splunk/Which-is-more-efficient-filldown-or-streamstats/m-p/269739#M2551 simpkins1958 2015-12-10T20:08:41Z https://community.splunk.com/t5/Monitoring-Splunk/Which-is-more-efficient-filldown-or-streamstats/m-p/269740#M2552 <P>Run both searches on your system searching your events over the same time range and check the job inspector for each search and you will get the answer which one will perform best for you in your environment.</P> Thu, 10 Dec 2015 20:14:09 GMT https://community.splunk.com/t5/Monitoring-Splunk/Which-is-more-efficient-filldown-or-streamstats/m-p/269740#M2552 MuS 2015-12-10T20:14:09Z https://community.splunk.com/t5/Monitoring-Splunk/Which-is-more-efficient-filldown-or-streamstats/m-p/269741#M2553 <P>What @MuS said (he beat me to it).</P> Thu, 10 Dec 2015 20:25:48 GMT https://community.splunk.com/t5/Monitoring-Splunk/Which-is-more-efficient-filldown-or-streamstats/m-p/269741#M2553 woodcock 2015-12-10T20:25:48Z https://community.splunk.com/t5/Monitoring-Splunk/Which-is-more-efficient-filldown-or-streamstats/m-p/269742#M2554 <P>filldown does <STRONG>not</STRONG> support "by" argument so if you need "by" arguments , filldown is not an right option for you . check here <A href="https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Filldown">https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Filldown</A> </P> Sat, 23 Feb 2019 09:49:43 GMT https://community.splunk.com/t5/Monitoring-Splunk/Which-is-more-efficient-filldown-or-streamstats/m-p/269742#M2554 RR5027153 2019-02-23T09:49:43Z