A non-streaming command waits until all of the events are gathered from the indexers before the command runs. For example, the
sort command must have the entire set of events before the events can be sorted. Non-streaming commands run on the search head. By contrast, a streaming command operates on each event as the event is returned by the search. Any command in a search that occurs after a non-streaming command must also be processed on the search head.
For more information
In the Search Manual:
On the Splunk Developer Portal: