The commands like stats, dedup ( I won't include sort with this), is quite useful and doing it early makes the total dataset much less
Let's take an example
1) index=windows | eval newUser=user| stats count by newUser
vs
2) index=windows| stats count by user| rename user as newUser
in (1), you are doing an evaluation/renaming on every single event. But in (2), you are aggregating and then doing rename, which may be only for handful of data
the key part is stats and dedup reduces the data/rows to very minimal than doing it on all data
Please do analysis yourself and see how the speed/performance difference is using your dataset.
... View more