https://community.splunk.com/t5/Splunk-Dev/Is-the-where-clause-a-streaming-or-non-streaming-command/m-p/374282#M6142 <P>Trying to optimize some queries and can't find a definitive answer on where the where clause runs. It <EM>looks</EM> like it is executing on the indexers because filtering the data before the stats command seems faster, but I'd like a straightforward answer. Thanks.</P> Wed, 02 May 2018 21:46:50 GMT tjago11 2018-05-02T21:46:50Z https://community.splunk.com/t5/Splunk-Dev/Is-the-where-clause-a-streaming-or-non-streaming-command/m-p/374282#M6142 <P>Trying to optimize some queries and can't find a definitive answer on where the where clause runs. It <EM>looks</EM> like it is executing on the indexers because filtering the data before the stats command seems faster, but I'd like a straightforward answer. Thanks.</P> Wed, 02 May 2018 21:46:50 GMT https://community.splunk.com/t5/Splunk-Dev/Is-the-where-clause-a-streaming-or-non-streaming-command/m-p/374282#M6142 tjago11 2018-05-02T21:46:50Z https://community.splunk.com/t5/Splunk-Dev/Is-the-where-clause-a-streaming-or-non-streaming-command/m-p/374283#M6143 <P><CODE>where</CODE> is a streaming command.</P> Thu, 03 May 2018 01:11:01 GMT https://community.splunk.com/t5/Splunk-Dev/Is-the-where-clause-a-streaming-or-non-streaming-command/m-p/374283#M6143 richgalloway 2018-05-03T01:11:01Z https://community.splunk.com/t5/Splunk-Dev/Is-the-where-clause-a-streaming-or-non-streaming-command/m-p/374284#M6144 <P>Can find the full list here.<BR /> <A href="http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Commandsbytype#Streaming_commands">http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Commandsbytype#Streaming_commands</A></P> Thu, 03 May 2018 01:47:16 GMT https://community.splunk.com/t5/Splunk-Dev/Is-the-where-clause-a-streaming-or-non-streaming-command/m-p/374284#M6144 somesoni2 2018-05-03T01:47:16Z