A command that runs on the indexer and can be applied to subsets of index data in a parallel manner. A streaming command applies a transformation to each event returned by a search. For example, the
rex command is streaming because it extracts and adds fields to events at search time. Streaming commands run in a distributed manner in parallel on individual indexers, unless the streaming command occurs after a non-streaming command.
In contrast, non-streaming commands are centralized and run at the search head. These commands analyze the entire set of data available at the search head, and then derive the search result output from that set.
In the Search Manual:
On the Splunk Developer Portal: