Using Stats command to outputlookup Vs using table command

[macadminrohit]

Hi,

To increase the performance of the search can we use stats command rather than table command to output the results to a lookup table?

[DalJeanis]

You might also want to look at using tstats if those are indexed fields. See if this gives you your desired result...

| tstats latest(Status) as Status where index=summary by Space Description 

[niketn]

@macadminrohit, if you want statistically aggregated data to be pushed to lookup file then definitely yes.

Do you mind sharing the current query with table and corresponding stats command?

Is the number of result and the data pushed to the lookup file through table and stats the same? If they are the same then use Job Inspector to check which query performs better.

[macadminrohit]

Hi Niket,

Here is the query :

index=summary Space=*
| stats latest(Status) as Status by Description Space
| table Space, Description, Status

The number of results are same and the time taken in using table command is almost 3 times more as shown by the job inspector.

I think here we are using table command to just rearrange the fields. Any recommendation of using stats command get the fields in the order as per our requirement. We are trying to output the result in a lookup file where order matters.

[somesoni2]

You can just use this to get things in order your need. The output field order is same as how you specify them in stats command. You first get all the fields that you specify in by clause, from left to right, then you get all the fields used in aggregate functions, again left to right.

index=summary Space=*
| stats latest(Status) as Status by Space Description 

[macadminrohit]

Want to mark this as the answer.