| CARVIEW |
Distributed Search
- System requirements and other deployment considerations for search head clusters
- Deploy a search head cluster
- Integrate the search head cluster with an indexer cluster
- Connect the search heads in clusters to search peers
- Add users to the search head cluster
- Use a load balancer with search head clustering
- Deploy a search head cluster in a multisite environment
- Deploy a single-member search head cluster
- Migrate settings from a standalone search head to a search head cluster
- Migrate from a search head pool to a search head cluster
- Upgrade a search head cluster
- Perform a rolling upgrade of a search head cluster
- Perform an automated rolling upgrade of a search head cluster
- Add a cluster member
- Remove a cluster member
- Configure a cluster member to run ad hoc searches only
- Control search concurrency on search head clusters
- Control captaincy
- Handle failure of a search head cluster member
- Use static captain to recover from loss of majority
- Put a search head cluster member into detention
- Restart the search head cluster
- Back up and restore search head cluster settings
- Download Splunk Conf 2016 Session materials
- Splunk Python SDK - How to call my custom search c...
- EUM stops logging virtual pages when we upgraded t...
- Load on application
- Metadata fields of custom search command
- Not able to see EUM Browser Data for configured Ap...
- Error Message on indexer console
Supported commands for parallel reduce search processing
Parallel reduce search processing supports a growing list of commands. The following table describes commands that are currently supported. It also describes restrictions for using some commands that don't support parallel reduce in certain use cases because the nature of the commands do not allow them to be pushed to intermediate reducers.
In most cases, you don't need to know when searches run with parallel reduce search processing because Splunk software automatically takes advantage of this optimization as conditions allow. If parallel reduce search processing is restricted or not supported on a command, your searches continue to deliver results as expected without using parallel reduce search processing.
| Command | Restrictions |
|---|---|
| dedup | Parallel reduce is not supported in searches with the sort by clause or consecutive=true argument.
|
| eventstats | The search requires a BY clause.
|
| lookup | Supported on Splunk Cloud Platform only. |
| sichart | |
| sistats | The search requires a BY clause.
|
| sitimechart | |
| sort | Parallel reduce can only enforce the order of events on a single intermediate reducer, and not across all intermediate reducers. As a result, parallel reduce does not support the sort command in the following cases:
|
| stats | The search requires a BY clause.
|
| streamstats | Parallel reduce is not supported in the following cases:
|
| table | Parallel reduce is not supported in searches that use the table command with field names that contain wildcards ( * ).
|
| transaction | Parallel reduce is not supported in searches with more than one field name in the field list. |
| tstats | The search requires a BY clause.
|
See also
| Configure parallel reduce search processing | About search head clustering |
This documentation applies to the following versions of Splunk® Enterprise: 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.1.8, 9.1.9, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4, 9.4.0, 9.4.1, 9.4.2
Comments
Download manual
Supported commands for parallel reduce search processing
You must be logged into splunk.com in order to post comments. Log in now.
Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.
Your Comment Has Been Posted Above
Feedback submitted, thanks!