streaming command

streaming command

noun

A command that runs on the indexer and can be applied to subsets of index data in a parallel manner. A streaming command applies a transformation to each event returned by a search. For example, the rex command is streaming because it extracts and adds fields to events at search time. Streaming commands run in a distributed manner in parallel on individual indexers, unless the streaming command occurs after a non-streaming command.

In contrast, non-streaming commands are centralized and run at the search head. These commands analyze the entire set of data available at the search head, and then derive the search result output from that set.

For more information

In the Search Manual:

• Types of commands

On the Splunk Developer Portal:

• Create custom search commands for apps in Splunk Cloud Platform or Splunk Enterprise