Which statement is correct?

Question

Options

• AIn general, search commands that can be distributed to the search peers should occur as early as
• BAs a streaming command, streamstats performs better than stats since stats is just a reporting
• CWhen trying to reduce a search result to unique elements, the dedup command is the only way to
• DFormatting commands such as fieldformat should occur as early as possible in the search to take

• A
  80% (44)
• B
  13% (7)
• C
  4% (2)
• D
  4% (2)

Explanation

Placing distributable commands early in a Splunk search pipeline is correct because it allows indexers (search peers) to process and reduce data locally before sending results to the search head, minimizing network transfer and improving performance - this is a foundational Splunk optimization principle.

Why the distractors are wrong:

• B is misleading: streamstats being a streaming command does not make it faster than stats. In fact, stats can be distributed to indexers, making it more efficient for large datasets; streamstats cannot be distributed and processes events sequentially.
• C is false: dedup is not the only way to get unique results. stats with a by clause (e.g., stats count by field) achieves the same goal and is often more efficient.
• D reverses the correct rule: formatting commands like fieldformat should appear late in the pipeline - they only affect display, not data, so applying them early wastes cycles on events that may still be filtered out.

Memory tip: Think "distribute early, format late" - push heavy computation to the peers as soon as possible, and save cosmetic formatting for the very end of the pipeline.

No community discussion yet for this question.