Is the where clause a streaming or non-streaming command.

[tjago11]

Trying to optimize some queries and can't find a definitive answer on where the where clause runs. It looks like it is executing on the indexers because filtering the data before the stats command seems faster, but I'd like a straightforward answer. Thanks.

[richgalloway · Accepted solution]

where is a streaming command.

[somesoni2]

Can find the full list here.
http://docs.splunk.com/Documentation/SplunkCloud/7.0.0/SearchReference/Commandsbytype#Streaming_comm...