From the links already shared above:
Think of a Batch mode search as a search that does NOT require searching on time-ordered events, for example, a search that uses the "stats" command which calculates aggregate statistics, such as average, count, and sum, over the results set. Other examples are searches that use transforming commands like chart, timechart, stats, top, rare, contingency, and highlight, which transform search result data into the data structures required for visualizations such as column, bar, line, area, and pie charts.
Requirements for batch mode search:
Transforming searches that meet the following conditions can run in batch mode.
* The searches need to use generating commands like search, loadjob, datamodel, pivot, or dbinspect.
* The search can include transforming commands, like stats, chart, and so on. However the search cannot include commands like localize and transaction.
* If the search is not distributed, it cannot use commands that require time-ordered events, like streamstats, head, and tail.
... View more