optimal order for doing dedup, fields and sort

[sideview]

I have lots of little searches and postProcess searches all over the place, where the request only needs a single sorted field out of a larger datacube set. (ie using one result to populate a series of pulldowns or a little clickable tables)

I used to do | stats count by fieldname | fields - count

but since the whole thing is in a macro anyway (with one argument), i switched a while ago to doing

| dedup fieldname | fields fieldname | sort fieldname

My reasoning I think being that the counting was unnecessary work.

Anyway, my questions are -

1. Is there more compact and/or better performing search-language that can do the same thing as this trio?
2. if dedup, fields and sort is sensible, is there an optimal order that these three operations should always be done in?
3. If there is a best practice with respect to ordering those three commands, where/when is the difference significant and why?

[steveyz · Accepted solution]

You can combine dedup and sort by using the 'sortby' keyword in the dedup command, e.g.

dedup x sortby y

Also, another caveat with dedup is that it could use unlimited memory for a high cardinality field (like some sort of unique identifier, e.g. ip address, cookie, etc)

---

EDIT:: adding in paraphrased version of 2 other comments that steveyz made on this topic via IM:

1. About ordering, fields should always be first. It's like pushing selection as early as possible. Things like fields, where, search, etc. Should be as early as possible
2. There are probably scenarios where dedup first might be a little faster, but that should be the edge case