@eus_e2e_engineeI'm not seeing a need for the append or the second search, as everything before the first pipe in both searches is the same. If there's no case, then that is indeed inefficient. Collect everything up front and then categorize away using evals. What you may be running into, is a filtering out of fields due to the stats command. If that's the case, I'd look into using eventstats and/or streamstats instead of stats. There's an old but relevant blog post here about those: https://www.splunk.com/en_us/blog/tips-and-tricks/search-command-stats-eventstats-and-streamstats-2.html ### If this reply helps you, an upvote would be appreciated.
... View more