non-streaming command

non-streaming command


A non-streaming command waits until all of the events are gathered from the indexers before the command runs. For example, the sort command must have the entire set of events before the events can be sorted. Non-streaming commands run on the search head. By contrast, a streaming command operates on each event as the event is returned by the search. Any command in a search that occurs after a non-streaming command must also be processed on the search head.

Related terms

For more information

In the Search Manual:

On the Splunk Developer Portal: