Trying to optimize some queries and can't find a definitive answer on where the where clause runs. It looks like it is executing on the indexers because filtering the data before the stats command seems faster, but I'd like a straightforward answer. Thanks.
where
is a streaming command.
where
is a streaming command.
Can find the full list here.
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Commandsbytype#Streaming_comm...