I have lots of little searches and postProcess searches all over the place, where the request only needs a single sorted field out of a larger datacube set. (ie using one result to populate a series of pulldowns or a little clickable tables)
I used to do | stats count by fieldname | fields - count
but since the whole thing is in a macro anyway (with one argument), i switched a while ago to doing
| dedup fieldname | fields fieldname | sort fieldname
My reasoning I think being that the counting was unnecessary work.
Anyway, my questions are -
You can combine dedup and sort by using the 'sortby' keyword in the dedup command, e.g.
dedup x sortby y
Also, another caveat with dedup is that it could use unlimited memory for a high cardinality field (like some sort of unique identifier, e.g. ip address, cookie, etc)
EDIT:: adding in paraphrased version of 2 other comments that steveyz made on this topic via IM:
You can combine dedup and sort by using the 'sortby' keyword in the dedup command, e.g.
dedup x sortby y
Also, another caveat with dedup is that it could use unlimited memory for a high cardinality field (like some sort of unique identifier, e.g. ip address, cookie, etc)
EDIT:: adding in paraphrased version of 2 other comments that steveyz made on this topic via IM: