I search the same time period in wineventlogs for host values with tstats (37,558) and with regular search (42,008):
| tstats count where index=wineventlog sourcetype=wineventlog
(TERM(LogName=Microsoft-Windows-PowerShell/Operational) OR TERM(SourceName=Microsoft-Windows-PowerShell))
(TERM(EventCode=4103) OR TERM(EventCode=4104) OR TERM(EventCode=4105) OR TERM(EventCode=4106)) by host
versus:
index=wineventlog sourcetype=wineventlog
(TERM(LogName=Microsoft-Windows-PowerShell/Operational) OR TERM(SourceName=Microsoft-Windows-PowerShell))
(TERM(EventCode=4103) OR TERM(EventCode=4104) OR TERM(EventCode=4105) OR TERM(EventCode=4106))
| stats count by host
The number of ComputerName values for the same time period is 41,656, which may be less simply due to the addition of new logs to the indexers for that time period before my searches above were run. Ironically, it took less time than my search on the indexed field "host" and I don't understand that either: 375s vs 430s, respectively.
