if you're going to stats on fieldX, don't dedup fieldX first … you do more than 2x the work, and your search'll run way slower 🙂
I did a write-up on this a couple years ago: https://antipaucity.com/2018/03/08/more-thoughts-on-stats-vs-dedup-in-splunk/#.X3IgUtYpDNI
September 28, 2020 at 01:43PM
via reddit https://www.reddit.com/r/Splunk/comments/j16rrl/using_count_as_part_of_another_search/g6z2sys?utm_source=ifttt