When is a distributable streaming command executed on an indexer?
Short answer
C If all preceding search commands are executed on the indexer.
Question
Key Takeaways
The question tests your understanding of Splunk's search command distribution model, with the common trap being to associate streamstats with indexer-side execution.
Learn when Splunk executes distributable streaming commands on indexers. Community consensus confirms option C: all preceding search commands must also execute on the indexer for the distributable streaming command to run there.
Common mistake: Choosing option B because streamstats is often mentioned as a distributable streaming command; however, streamstats is not automatically executed on the indexer unless all preceding commands are also distributable or indexer-eligible.
Expert Analysis
Why the Answer Is Correct
Option C is correct because Splunk executes a distributable streaming command on the indexer only when every preceding command in the search pipeline can also run on the indexer. This requirement preserves the correctness of the distributed execution model—indexers process their local data independently, and the search head only handles commands that need centralized results. As commenter [3] noted, these commands process data in parallel across indexers and do not require centralized processing by the search head.
Why the Other Options Are Wrong
Option A is wrong because a distributable streaming command will not run on the indexer if any preceding command forces the search head to take over; the search head would then process the whole pipeline. Option B is wrong because streamstats, although a streaming command, does not automatically enable indexer execution—if preceding commands cannot run on the indexer, streamstats will not run there either. Option D is wrong because timechart is a transforming command that requires aggregation on the search head, so it would prevent indexer-side execution of a later distributable streaming command.
Community Comment Notes
The clear majority voted for C, with comment [1] citing Splunk's official documentation on command types. Comment [2] incorrectly suggested B, but other commenters and the official documentation confirm that streamstats is not a special exception. Comment [3] explained the parallel-processing nature of distributable streaming commands, and comment [4] reinforced that the other commands in the search determine execution location.
Official Reference
https://docs.splunk.com/Documentation/Splunk/9.3.1/Search/Typesofcommands
This link opens the official vendor documentation in a new tab.
Exam Strategy
Remember the rule: a command runs on the indexer only if all preceding commands are also indexer-eligible. When you see streamstats or timechart in a question, check whether the entire pipeline can run on the indexer—don't assume a single command name determines execution location.
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
Soccerfan 👍 3C - https://docs.splunk.com/Documentation/Splunk/9.3.1/Search/Typesofcommands
-
Derag 👍 2No, B is the correct answer. A distributable streaming command is a search command that can be executed on the indexer instead of the search head. This can improve search performance by reducing the amount of data that needs to be sent over the network. The streamstats command is a distributable streaming command that can be executed on the indexer if all preceding search commands are also executed on the indexer. This is because streamstats requires access to the raw event data, which is not available on the search head. Therefore, if all preceding search commands are executed on the indexer, and a streamstats command is used, the streamstats command will be executed on the indexer.
-
emlch 👍 1It has nothing to do with streamstats. A streaming command operates on each event returned by a search. For distributable streaming, the order of the events does not matter. A distributable streaming command is a command that can be run on the indexer, which improves processing time. The other commands in a search determine if the distributable streaming command is run on the indexer: If all of the commands before the distributable streaming command can be run on the indexer, the distributable streaming command is run on the indexer. If any one of the commands before the distributable streaming command must be run on the search head, the remaining commands in the search must be run on the search head. When the search processing moves to the search head, it can't be moved back to the indexer.
-
cagdaskarabag 👍 1 Answered CA distributable streaming command in Splunk is executed on the indexer when all preceding commands in the search pipeline are also distributable streaming commands or commands that can run on the indexer. These commands process data in parallel across indexers and do not require centralized processing by the search head.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SPLK-1004 Questions
Access 130 questions with complete answers and detailed explanations.
View Full SPLK-1004 Practice Test →