Splunk Search

Is eventstats a "Distributable" command ?

KarunK
Contributor

Hi All,

I am trying to improve my run time for a large search and i need some help to identify whether eventstats is a Distributable command. From the documentation i know streamstats is Centralized streaming. link:SearchReference/Commandsbytype
What i am trying to achive is not to use those search commands which requires data to be uploaded to Search Heads.

Thanks for your help.

Regards

0 Karma

michael_bates_1
Path Finder

From the doco.

Other commands
There are a handful of commands that do not fit into these categories. These commands are non-transforming, not distributable, and not streaming: sort, eventstats, some modes of dedup, and some modes of cluster.

0 Karma

woodcock
Esteemed Legend

The eventstats command has the same distribution limitations/characteristics (or not) as stats does so it should fall into the same category as stats, not streamstats. It is interesting that eventstats does not appear at all on that page.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Strangely eventstats is not listed but based on its similarity to streamstats, my bet will be on centralized streaming.

0 Karma

KarunK
Contributor

That was my guess too. Thanks for your response. Appreciate that.
Any one else have a different opinion ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...