https://community.splunk.com/t5/Splunk-Search/Using-Fields-Efficiently/m-p/54982#M13406 <P>If you really want to go that way, use the search inspector (the "i" button) to see the search speed.<BR /> and run the same search on the same time window with several variations of your search.</P> Thu, 06 Dec 2012 07:14:43 GMT yannK 2012-12-06T07:14:43Z https://community.splunk.com/t5/Splunk-Search/Using-Fields-Efficiently/m-p/54981#M13405 <P>I'm trying to get a search to run as efficiently as possible and a couple of the guys on my team have been going back and forth regarding the placement of the 'fields' syntax.</P> <P>I have always put the 'fields' syntax immediately after my sourcetype, but some people put it in the middle of the search, some put it before/after the math that is done, some put it right before the 'stats', 'table', etc. </P> <P>I looked in the documentation, but I didn't see anything saying that it should go "here" or "there".</P> <P><STRONG>Is there a preferred place to put the 'fields' syntax?</STRONG></P> Wed, 05 Dec 2012 15:49:51 GMT https://community.splunk.com/t5/Splunk-Search/Using-Fields-Efficiently/m-p/54981#M13405 peasead 2012-12-05T15:49:51Z https://community.splunk.com/t5/Splunk-Search/Using-Fields-Efficiently/m-p/54982#M13406 <P>If you really want to go that way, use the search inspector (the "i" button) to see the search speed.<BR /> and run the same search on the same time window with several variations of your search.</P> Thu, 06 Dec 2012 07:14:43 GMT https://community.splunk.com/t5/Splunk-Search/Using-Fields-Efficiently/m-p/54982#M13406 yannK 2012-12-06T07:14:43Z https://community.splunk.com/t5/Splunk-Search/Using-Fields-Efficiently/m-p/54983#M13407 <P>Great idea.</P> <P>As it turns out, it doesn't matter much.</P> Thu, 06 Dec 2012 17:05:30 GMT https://community.splunk.com/t5/Splunk-Search/Using-Fields-Efficiently/m-p/54983#M13407 peasead 2012-12-06T17:05:30Z