Which is more efficient - filldown or streamstats

[simpkins1958]

... | sort _time | filldown l_lat l_lon by UID | table _time UID w_tbys w_tbyr l_lat l_lon 

or

... | sort _time | streamstats last(l_lat) as lastLat last(l_lon) as lastLon by UID | table _time UID w_tbys w_tbyr l_lat lastLat l_lon lastLon

[RR5027153]

filldown does not support "by" argument so if you need "by" arguments , filldown is not an right option for you . check here https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Filldown

[MuS]

Run both searches on your system searching your events over the same time range and check the job inspector for each search and you will get the answer which one will perform best for you in your environment.

[woodcock]

What @MuS said (he beat me to it).