more thoughts on `|stats` vs `|dedup` in splunk
Yesterday I wrote-up a neat little find in Splunk wherein running stats count by … is substantially faster than running dedup …. After some further reflection over dinner, I figured out the major portion of why this is – and I feel a little dumb for not having thought of it before. (A coworker added some…
continue “more thoughts on `|stats` vs `|dedup` in splunk” »