Supported commands for parallel reduce search processing
Parallel reduce search processing supports a growing list of commands. The following table describes commands that are currently supported. It also describes restrictions for using some commands that don't support parallel reduce in certain use cases because the nature of the commands do not allow them to be pushed to intermediate reducers.
In most cases, you don't need to know when searches run with parallel reduce search processing because Splunk software automatically takes advantage of this optimization as conditions allow. If parallel reduce search processing is restricted or not supported on a command, your searches continue to deliver results as expected without using parallel reduce search processing.
Command | Restrictions |
---|---|
dedup | Parallel reduce is not supported in searches with the sort by clause or consecutive=true argument.
|
eventstats | The search requires a BY clause.
|
lookup | Supported on Splunk Cloud Platform only. |
sichart | |
sistats | The search requires a BY clause.
|
sitimechart | |
sort | Parallel reduce can only enforce the order of events on a single intermediate reducer, and not across all intermediate reducers. As a result, parallel reduce does not support the sort command in the following cases:
|
stats | The search requires a BY clause.
|
streamstats | Parallel reduce is not supported in the following cases:
|
table | Parallel reduce is not supported in searches that use the table command with field names that contain wildcards ( * ).
|
transaction | Parallel reduce is not supported in searches with more than one field name in the field list. |
tstats | The search requires a BY clause.
|
See also
Configure parallel reduce search processing | About search head clustering |
This documentation applies to the following versions of Splunk® Enterprise: 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1
Feedback submitted, thanks!