dataset processing command

dataset processing command

noun

A type of search command that requires the entire dataset to be gathered in one place before the command can run. Dataset processing commands are not transforming, not distributable, not streaming, and not orchestrating.

Dataset processing commands include eventstats, outlier, reverse, and sort.

Some commands become dataset processing commands in specific situations or when specific arguments are used. These include bin, dedup, filllnull, from, transaction, and union.

For more information

In the Search Manual:

• Types of commands

In the Search Reference:

• Dataset processing commands