request optimization with best practices

[jip31]

hello

I use the request below but i would like to have an example of doing this code more performant following splunk best practices
could you help me please?

 index="windows" sourcetype="wineventlog:Application" SourceName="*" 
Type="Critique" OR Type="Avertissement" OR Type="Erreur" 
| dedup host 
| stats count by host   

| join host [search index="windows-wmi" sourcetype="WMI:ModelPC" |rex "Model=(?<model>.*)"|stats values(model) as Model by host]
| stats count values(host) by Model | rename count as Total | table Model Total | sort -Total limit=10

[koshyk · Accepted solution]

Please try like below ( I haven't tested it, but just the concept)

[index="windows" sourcetype="wineventlog:Application" SourceName="*"  (Type="Critique" OR Type="Avertissement" OR Type="Erreur" ) | stats count by host | fields host]   index="windows-wmi" sourcetype="WMI:ModelPC"  
|rex "Model=(?<model>.*)"|stats values(model) as Model by host

[jip31]

thanks a lot