Which is faster, appendcols with second search or replacing values?

[gcharles]

I would like to understand which of the following is the fastest and why or if there are any more faster ways to achieve the same thing...

Method 1 - appendcols with second search

index="index1" (app="outbound-service" message="Outbound Successful*") 
|  rex field=message "Amount=(?[0-9]+)"
| eval outboundAmount=outboundAmount/100 
| timechart span=1d sum(outboundAmount) as "Outbound ($)"
|  appendcols 
    [search index="index1" (app="inbound-service" message="Inbound Successful*") 
|  rex field=message "Amount=(?[0-9]+)"
| eval inboundAmount=inboundAmount/100 
| timechart span=1d sum(inboundAmount) as "Inbound ($)"]

Method 2 - replacing values and timechart 'by'

index="index1" (app="outbound-service" message="Outbound Successful*") OR (app="inbound-service" message="Inbound Successful*")
|  rex field=message "Amount=(?[0-9]+)"
| eval amount=amount/100 
|  replace "outbound-service" with "Outbound ($)" in app
|  replace "inbound-service" with "Inbound ($)" in app
| timechart span=1d sum(amount) by app

... or further alternatives...

I know for method two I could not worry about the replacements which would save time but I would like the timehchart to have nicer labels.

[niketn · Accepted solution]

@gcharles appendcols will have sub search limitation, so option 2 would definitely be better than option 1. Have you tried running the two query with bulk data and use Search Job Inspector to compare their performance?
You should however use

Option 3 using rename to format column name after timechart
Instead of replacing the values in the data you can perform timechart with actual app name and then use rename command in the end to format the column name.

 index="index1" (app="outbound-service" message="Outbound Successful*") OR (app="inbound-service" message="Inbound Successful*")
 |  rex field=message "Amount=(?[0-9]+)"
 | eval amount=amount/100 
 | timechart span=1d sum(amount) by app
 |  rename "outbound-service" as "Outbound ($)",
                    "inbound-service" as "Inbound ($)"

Following is a run anywhere example based on Splunk's _internal index

index=_internal sourcetype=splunkd log_level!=INFO
| timechart count by log_level
| rename "ERROR" as "Splunkd Errors", "WARN" as "Splnkd Warnings"

[gcharles]

Thanks. That was really what I was after, renaming the labels after the timechart process. Thanks again.