Data Model Acceleration, or report acceleration are good ways to solve this challenge in general. with report acceleration, you just save the search, click the accelerate button, and Splunk will pre-calculate all those details for you. Data Model Acceleration will require you to change your query a bit, but is valuable if you also do a bunch of other analysis on that dataset that you would also like accelerated.
For more, check out report acceleration or data model acceleration at docs.splunk.com, and there's also great detail on both topics at conf.splunk.com -- just check out 2014 sessions and search the page for "acceleration" or "Data Model"
... View more