Which commands scale/distribute well

[chris]

If I have a Splunk environment/installation that consists of at least one search head and multiple indexer installations is there an easy way to determine which commands perform well (and which commands do not)?

From the following technical paper I found out, that there is a map and a reduce part for every search:
http://www.splunk.com/web_assets/pdfs/secure/Splunk_and_MapReduce.pdf

I am assuming that streaming commands are the ones that can be run in parallel during the map part of the search:
http://docs.splunk.com/Splexicon:Streamingcommand

I am also assuming that in the Job inspector the "remoteSearch" part is the part of the search that can be run in parallel which is efficient:
http://docs.splunk.com/Documentation/Splunk/6.1.2/Knowledge/ViewsearchjobpropertieswiththeJobInspect...

From experience I know, that the "stats" command can be a much better option (from performance perspective) than "transaction".

Is there any documentation with information about performance/internals about how the commands distribute?

Thanks
Chris

[Jason]

Any update on this? I thought I heard of some document improving on http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutthesearchlanguage#Types_of_search_com... recently.

[sophy · Accepted solution]

Hi Chris,

No there is not a document that discusses specifically how commands distribute in Splunk (or which commands are/are not distributable). yet.

And, yes. You are correct about streaming commands and remoteSearch.

Thanks!