Splunk® Enterprise

Search Reference

Download manual as PDF

Download topic as PDF

Command types

There are four broad types for all of the search commands: distributable streaming, centralized streaming, transforming, generating.


Streaming commands



Command Notes
addinfo Distributable streaming
autoregress Centralized streaming.
bin Streaming if specified with the span argument.
cluster Streaming in some modes.
convert Distributable streaming.
dedup Streaming in some modes.
eval Distributable streaming.
extract Distributable streaming.
fieldformat Distributable streaming.
fields Distributable streaming.
fillnull Streaming with specific arguments.
head Centralized streaming.
highlight Distributable streaming.
iconify Distributable streaming.
iplocation Distributable streaming.
join Centralized streaming, as long as there is a defined set of fields to join to.
lookup Distributable streaming when specified with local=false
makemv Distributable streaming.
multikv Distributable streaming.
mvexpand Distributable streaming.
nomv Distributable streaming.
rangemap Distributable streaming.
regex Distributable streaming.
reltime Distributable streaming.
rename Distributable streaming.
replace Distributed streaming.
rex Distributable streaming.
search Distributable streaming if used further down the search pipeline. Generating when the first command in the search.
spath Distributable streaming.
strcat Distributable streaming.
streamstats Centralized streaming.
tags Distributable streaming.
transaction Centralized streaming.
typer Distributable streaming.
where Distributable streaming.
untable Distributable streaming.
xmlkv Distributable streaming.
xpath Distributable streaming.
xyseries Distributable streaming if the argument grouped=false>, otherwise Transforming

Generating commands


Command Notes
crawl Report-generating.
datamodel Report-generating
dbinspect Report-generating.
eventcount Report-generating.
inputcsv Event-generating (centralized).
loadjob Event-generating (centralized).
makeresults Report-generating.
multisearch Event-generating.
pivot Report-generating.
search Event-generating (distributable) when the first command in the search, which is the default. Distributable streaming if used as a subsearch.
searchtxn Event-generating.
set Event-generating.
tstats Report-generating.

Transforming commands


Note: In earlier versions of Splunk software, transforming commands were referred to as "reporting commands."

Command Notes
xyseries Transforming if grouped=true, otherwise distributable streaming.
Commands by category
Splunk SPL for SQL users




Thank you for your comments. The table command is really a basic transforming command.
I appreciate you finding the grammar issue. I have corrected that. As for “distributable”, I checked Merriam-Webster and it is indeed a valid adjective. I will investigate further about where each command executes. It is most relevant for the streaming commands, which is why we put the emphasis there.

Lstewart splunk, Splunker
October 31, 2016

The eventstats command is like the sort command, it does not really fit into any of these categories. This is actually mentioned in the Search Manual here: http://docs.splunk.com/Documentation/Splunk/latest/Search/Typesofcommands

Lstewart splunk, Splunker
October 31, 2016


Table doesnt appear in this list. I think it should be under streaming command as "centralized".

Also found a grammar issue here:
A distributable streaming command *are run* (should be "is ran" or "executes") on the indexer or the search head, depending on where in the search the command is invoked. Distributable streaming commands can be applied to subsets of indexed data in a parallel manner

Also distributable is not a word.

Finally, it seems like each type of command should mention where it executes. I see distributable and centralized are noted on some generating and transforming commands, but you have way more details about what each do under the first type, Streaming... Perhaps we should have bullets for each type of command that explains the whole distributable/centralized aspects OR maybe just one "this applies to all commands" bullet list at the top of the page...


October 19, 2016

The `eventstats` command does not appear on this page anywhere (and surely other, even more-recently-added commands, too). A full command audit should be performed and this page updated accordingly.

May 22, 2016

Was this documentation topic helpful?





0 out of 1000 Characters