Traditionally when building a Splunk search, you will write the search first to get the correct layout and accurate results. Then using Splunk's fields command, the performance of the search can be improved, sometimes dramatically depending the logic contained in the search.
By default, when you search an index and return events, Splunk will query and return all of the event fields. However in most searches producing statistical results, having all the fields from the event is not necessary because they are not all required to create the output.
An example of a Splunk search before the fields command:
index=main http_uri=/booking/reservation http_status_code=200 | stats count by http_user_agent
An example of the search after applying the fields command will produce the same results more quickly:
index=main http_uri=/booking/reservation http_status_code=200 | fields http_user_agent | stats count by http_user_agent
In the case above, the only field returned from the search of the index is the http_user_agent field. No other event fields are unnecessarily captured and loaded into memory to produce the output due to the fields command. Using the fields command is a great way to improve searches after the results have been proven to be accurate.