There are three basic components to a Splunk search, and all of them have an effect on how quickly the data itself is rendered in your search panel.
This is the portion of the search that defines where the data itself is located within Splunk. It consists of any one of the four core Splunk fields. Index, sourcetype, source, and host are the core Splunk fields that can only be aliased; it usually not advisable to write them.
This is the portion of the search where we leverage some statistical functions, eval functions, or multi-value field functions in order to prepare the data we are searching for and the way we want to present it. The order of functions is very critical in this section of the query and is usually the largest portion of a search.