Dedup performance 1 field vs multiple fields vs concatenated field

[wfskmoney]

Which one would be faster or better in general:

1. | dedup fieldA fieldB --> I would assume that Splunk does a concatenation in the background
2. | eval fieldAB = fieldA.fieldB | dedup fieldAB

[gcusello · Accepted solution]

Hi wfskmoney,
I didn't found great differences between the methods (a few hundredths of a second):
scan ot 700,000 events in 8.568 s. in the first case and 8.529 s. in thesecond case.

Bye.
Giuseppe