Distributed vs Streaming command

[valiquet]

Is there a way to know the load an SPL query puts on the index vs the search head cluster when running? By looking at the doc, it's not always clear, so perhaps is there some REST call or job inspector values I can check?

If not, some CLI could give us some clues inside var/run/lib.

Thanks

[jkat54 · Accepted solution]

If you let the job finish and look at the job inspector, you can see how long each part of the search required, how many events went into each step and how many came out. That combined with the list of known distributed vs streaming commands will provide some insight here.