non-streaming command

non-streaming command

noun

A non-streaming command waits until all of the events are gathered from the indexers before the command runs. For example, the sort command must have the entire set of events before the events can be sorted. Non-streaming commands run on the search head. By contrast, a streaming command operates on each event as the event is returned by the search. Any command in a search that occurs after a non-streaming command must also be processed on the search head.

Related terms

• streaming command
• search head

For more information

In the Search Manual:

• Types of commands

On the Splunk Developer Portal:

• Create custom search commands for apps in Splunk Cloud Platform or Splunk Enterprise