The "correct" answer is the one @RichG gave
However, as with most things in life, the "reality" answer is "it depends"
It should be the case that filtering before sorting will be more efficient
But I have seen instances where filtering later is actually more efficient (depends on a host of factors) – so you really need to try it both ways to be sure
Docs.Splunk links:
from User warren – Stack Overflow https://stackoverflow.com/questions/69485944/where-vs-sort-which-is-more-efficient/69486756#69486756
via IFTTT