Can we improve on a standard index=index_name sourcetype=*prod | stats query?

[ddrillic]

We have this standard query -

index=<index name> sourcetype=*prod clientID=*aaa OR clientID=bbbb OR clientID=*ccc OR clientID=*ddd
|  stats count by  clientID apiName
|  eval applicationName=case(
clientID="<client_id>", "<nicer name>", 
....)
|  fields - clientID
|  fields applicationName apiName count
|  sort applicationName

Are there more performant options for such a query?

[adonio · Accepted solution]

if those are indexed extractions (at index or using datamodel acceleration) you can do this:

 |  tstats count where index=<index name> sourcetype=*prod clientID=*aaa OR clientID=bbbb OR clientID=*ccc OR clientID=*ddd by  clientID apiName
     |  eval applicationName=case(
     clientID="<client_id>", "<nicer name>", 
     ....)
     |  fields - clientID
     |  fields applicationName apiName count
     |  sort applicationName

[ddrillic]

Much appreciated @adonio.

[ddrillic]

Very interesting @adonio - thank you.

[cmerriman]

i MAY be mistaken, but if you put fields at the beginning, it might be helpful, so splunk only grabs relevant fields and isn't looking at anything else.
index= sourcetype=*prod clientID=*aaa OR clientID=bbbb OR clientID=*ccc OR clientID=*ddd
| fields clientID apiName
| stats count by clientID apiName
| eval applicationName=case(clientID="", "", ....)
| fields - clientID
| sort applicationName

[ddrillic]

Makes perfect sense @cmerriman!!