When would a distributable streaming command be executed on an indexer?
When would a distributable streaming command be executed on an indexer?
A distributable streaming command would be executed on an indexer if all preceding search commands are executed on the indexer. This ensures that the data processing can continue on the indexer, leveraging its capabilities before any possible transition to the search head. Any command that has to be performed by the search head will terminate the data processing on the indexer.
No, B is the correct answer. A distributable streaming command is a search command that can be executed on the indexer instead of the search head. This can improve search performance by reducing the amount of data that needs to be sent over the network. The streamstats command is a distributable streaming command that can be executed on the indexer if all preceding search commands are also executed on the indexer. This is because streamstats requires access to the raw event data, which is not available on the search head. Therefore, if all preceding search commands are executed on the indexer, and a streamstats command is used, the streamstats command will be executed on the indexer.
streamstats is a centralized streaming command and NOT a distributable.
It has nothing to do with streamstats. A streaming command operates on each event returned by a search. For distributable streaming, the order of the events does not matter. A distributable streaming command is a command that can be run on the indexer, which improves processing time. The other commands in a search determine if the distributable streaming command is run on the indexer: If all of the commands before the distributable streaming command can be run on the indexer, the distributable streaming command is run on the indexer. If any one of the commands before the distributable streaming command must be run on the search head, the remaining commands in the search must be run on the search head. When the search processing moves to the search head, it can't be moved back to the indexer.