Hi All,
I am trying to improve my run time for a large search and i need some help to identify whether **eventstats** is a **Distributable** command. From the documentation i know **streamstats is Centralized streaming**. link:[SearchReference/Commandsbytype](http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Commandsbytype "Commandsbytype")
What i am trying to achive is not to use those search commands which requires data to be uploaded to Search Heads.
Thanks for your help.
Regards
↧