Is there a way to use the sort command in a search, but still accelerate the report?

[IRHM73]

Hi,

I wonder whether someone may be able to help please.

I'm using the search below to return a given number of statistics.

auditSource=preferences auditType=TxSucceeded detail.input-preference-digital=*  
 |  replace "true" with "Opted In", "false" with "Opted Out" in detail.input-preference-digital 
 | sort 0 detail.input-utr,-_time |eval inOrOut='detail.input-preference-digital' 
 | stats first(inOrOut) As inOrOut By detail.input-utr  
 | chart count by inOrOut 
 | eval pieSlice=inOrOut  + " " + count  
 |fields pieSlice, count

The problem I have is that I want to 'Accelerate' the report, but I know, from advice I've been given on this forum, that I can't because of the 'sort' command.

Could someone tell me please is there a way to use both the 'Sort' command and 'Accelerate' the report.

Many thanks and kind regards

Chris

[lguinn2 · Accepted solution]

You don't need the sort because the following stats command automatically sorts on the fields in the by clause. This will work

 auditSource=preferences auditType=TxSucceeded detail.input-preference-digital=*  
| rename "detail.input-preference-digital" as inOrOut
| replace "true" with "Opted In", "false" with "Opted Out" in inOrOut
| stats first(inOrOut) As inOrOut By detail.input-utr  
| chart count by inOrOut 
| eval pieSlice=inOrOut  + " " + count  
| fields pieSlice, count

I also exchanged one of the eval commands with a rename, which is faster. You should see a speed improvement with the updated search. And this search should accelerate.

[IRHM73]

Hi @Iguinn, thank you once more for taking the time to reply to my post and for the guidance.

Many thanks and kind regards

Chris