dataset processing command

dataset processing command


A type of search command that requires the entire dataset to be gathered in one place before the command can run. Dataset processing commands are not transforming, not distributable, not streaming, and not orchestrating.

Dataset processing commands include eventstats, outlier, reverse, and sort.

Some commands become dataset processing commands in specific situations or when specific arguments are used. These include bin, dedup, filllnull, from, transaction, and union.

For more information

In the Search Manual:

In the Search Reference: