A municipal hunt is streaming every clerk-PC endpoint event into the search UI before anyone counts users. What efficient-search change should come first?

When a municipal hunt only needs counts—such as how many clerk-PC users matched—an early transforming command (stats or tstats) prevents shipping every raw endpoint event to the search UI. Transforming early collapses the stream at the indexers so the browser receives aggregate rows, which is foundational efficient-search practice on busy civic search heads. Removing the time bound makes streaming worse by expanding the raw flood into the UI. Verbose mode increases extracted fields and stream cost without answering the count faster. Wrapping a week of raw events in transaction before aggregating maximizes memory use and delays the answer the SOC actually asked. Exam caveat: if the analyst truly needs raw event review, constrain time and index first and sample; do not confuse investigation of a few events with a fleet-wide count query. Operational check: rewrite the clerk-PC count hunt to place stats or tstats immediately after the minimum filters, confirm the UI shows aggregates rather than an event flood, and document that transforming early is required before sharing the search with the wider SOC. Document the revised SPL in the civic SOC runbook so the next on-call analyst inherits the efficient pattern rather than the anti-pattern.