As @chris points out in [another question][1], the following paper implies that Splunk uses map-reduce in a particular way: [http://www.splunk.com/web_assets/pdfs/secure/Splunk_and_MapReduce.pdf][2]
He also points out that you can see the "remoteSearch" that is sent to the indexers by using the Search Job Inspector.
Also, we know from the docs that stats is a transforming command.
[http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Typesofcommands][3]
[http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Commandsbytype][4]
So here is the question:
Does stats *distribute*? And if stats distributes, what about the other transforming commands?
By that I mean, is stats a "distributable" command?
I can guess at the answer, but it would be nice to get the "real" answer!
[1]: https://answers.splunk.com/answers/124752/which-commands-scale-distribute-well.html
[2]: http://www.splunk.com/web_assets/pdfs/secure/Splunk_and_MapReduce.pdf
[3]: http://docs.splunk.com/Documentation/Splunk/6.4.1/Search/Typesofcommands
[4]: http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Commandsbytype
↧