As you learn around SPL, you can hear the state streaming, generating, transforming, orchestrating, and data processing used to describe the species of search commands. This topic explains what this terms mean and also lists the regulates that loss into every category.

You are watching: Commands that create statistics and visualizations are called _______________ commands.

There are six large categorizations because that almost every one of the search commands:

distributable streamingcentralized streamingtransforminggeneratingorchestratingdataset processing

These categorizations room not mutually exclusive. Some regulates fit into only one categorization. The stats command is an instance of a command the fits only into the transforming categorization. Other commands can fit into multiple categorizations. For example a command have the right to be streaming and also generating.

For a complete list of regulates that space in every type, check out Command types in the find Reference.

Streaming and non-streaming commands

A streaming command operates top top each event as it is went back by a search. Basically one occasion in and one (or no) event out.


For example, the eval command can produce a new field, full_name, come contain the concatenation of the worth in the first_name field, a space, and the value in the last_name field.

... | eval full_name = first_name." ".last_name

The eval command evaluates each event without considering the various other events.

A non-streaming command calls for the occasions from all of the indexers before the command deserve to operate ~ above the entire set of events. Plenty of transforming regulates are non-streaming commands. Over there are additionally several commands that room not transforming commands but that space non-streaming. This non-transforming, non-streaming commands are sometimes referred come as event based non-streaming commands.


For example, before the sort command can begin to type the events, the entire set of events must be obtained by the type command. Other examples of non-streaming regulates include dedup (in some modes), stats, and top.

Non-streaming regulates force the entire set of events to the find head. This needs a many data movement and also a loss of parallelism.

For info on how to mitigate the price of non-streaming commands, see Write much better searches in this manual.

Processing attributes

The complying with table describes the processing differences between some the the types of commands.

Distributable streamingCentralized streamingData processing (non-streaming)Transforming
Can run on indexersYNNN
Can output before final inputYYNN
Outputs events if inputs space eventsYYYN

When a command is operation it outputs either occasions or results, based on the kind of command. For example, once you run the kind command, the input is events and also the calculation is events in the kind order girlfriend specify. However, transforming commands do not output events. Transforming regulates output results. For example the stats command outputs a table of calculated results. The occasions used to calculate those outcomes are no much longer available. After ~ you run a transforming command, you can"t operation a command the expects occasions as an input.

Data processing regulates are non-streaming regulates that require the whole dataset before the command have the right to run. These regulates are not transforming, not distributable, no streaming, and not orchestrating. The type command is an instance of a data processing command. See Data handling commands.

Distributable streaming

A streaming command operates top top each occasion returned through a search. For distributable streaming, the stimulate of the occasions does not matter. A distributable streaming command is a command that have the right to be operation on the indexer, which improves processing time. The other regulates in a search recognize if the distributable streaming command is operation on the indexer:

If every one of the commands before the distributable streaming command can be operation on the indexer, the distributable streaming command is operation on the indexer.If any one of the commands prior to the distributable streaming command need to be run on the find head, the remaining regulates in the find must be run on the search head. As soon as the search handling moves to the find head, it can not move ago to the indexer.

Distributable streaming regulates can be applied to subsets of indexed data in a parallel manner. For example, the rex command is streaming. It extracts fields and also adds castle to events at search time.

Some of the typical distributable streaming regulates are: eval, fields, makemv, rename, regex, replace, strcat, typer, and also where.

For a finish list of distributable streaming commands, see Streaming regulates in the search Reference.

Centralized streaming

For central streaming commands, the order of the occasions matters. A centralized streaming command uses a transformation to each event returned through a search. But unlike distributable streaming commands, a central streaming command only works on the search head. You might likewise hear the hatchet "stateful streaming" to describe these commands.

Centralized streaming regulates include: head, streamstats, some modes of dedup, and also some settings of cluster.


A transforming command order the search results into a data table. These commands "transform" the stated cell worths for each event into numerical worths that software have the right to use for statistical purposes. Transforming regulates are no streaming. Also, transforming commands are compelled to change search result data right into the data frameworks that are forced for visualizations such together column, bar, line, area, and also pie charts.

Transforming regulates include: chart, timechart, stats, top, rare, and also addtotals once it is offered to calculate column totals (not heat totals).

For an ext information around transforming commands and their duty in produce statistical tables and also chart visualizations, see about transforming commands and searches in the this manual.

For a complete list that transforming commands, check out Transforming commands in the search Reference.


A generating command fetches information from the indexes, without any type of transformations. Generating commands are either event-generating (distributable or centralized) or report-generating. Many report-generating regulates are likewise centralized. Depending upon which kind the command is, the results are reverted in a perform or a table.

Generating commands do not expect or call for an input. Generating regulates are normally invoked at the start of the search and also with a top pipe. That is, over there cannot be a find piped right into a generating command. The exemption to this is the find command, because it is implicit in ~ the start of a search and also does not need to be invoked.

Examples of generating regulates include: dbinspect, datamodel, inputcsv, metadata, pivot, search, andtstats

For a finish list of generating commands, see Generating regulates in the find Reference.


An orchestrating command is a command that controls some element of exactly how the find is processed. That does not directly influence the final an outcome set of the search. Because that example, girlfriend might apply an orchestrating command come a search to enable or disable a search optimization that helps the overall search finish faster.

Examples of orchestrating commands include redistribute, noop, and also localop. The lookup command additionally becomes an orchestrating command when you usage it v the local=t argument.

Dataset processing

There room a handful of regulates that need the entire dataset before the command have the right to run. These regulates are referred to as dataset processing commands. These commands are not transforming, not distributable, not streaming, and not orchestrating. Few of these commands fit into other varieties in certain situations or when certain arguments space used.

Examples the data processing commands include: sort, eventstats, and some settings of cluster, dedup, and fillnull.

See more: Fifa 17 Deluxe Edition Vs Standard /Deluxe/Superdeluxe? — Fifa Forums

For a finish list the dataset processing commands, view Dataset processing commands in the search Reference.

PREVIOUSTypes of searchesNEXTSearch v Web, CLI, or remainder API

This documentation uses to the complying with versions that® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.2.0, 8.2.1, 8.2.2