Supported commands for parallel reduce search processing

Parallel reduce search processing supports a growing list of commands. The following table describes commands that are currently supported. It also describes restrictions for using some commands that don't support parallel reduce in certain use cases because the nature of the commands do not allow them to be pushed to intermediate reducers.

Note: In most cases, you don't need to know when searches run with parallel reduce search processing because Splunk software automatically takes advantage of this optimization as conditions allow. If parallel reduce search processing is restricted or not supported on a command, your searches continue to deliver results as expected without using parallel reduce search processing.
Command Restrictions
dedup Parallel reduce is not supported in searches with the sort by clause or consecutive=true argument.
eventstats The search requires a BY clause.
lookup Supported on Splunk Cloud Platform only.
sichart
sistats The search requires a BY clause.
sitimechart
sort Parallel reduce can only enforce the order of events on a single intermediate reducer, and not across all intermediate reducers. As a result, parallel reduce does not support the sort command in the following cases:
  • In searches where sort is the only command.
  • In searches with a sort limit of a positive value, for example, sort limit=10000.
  • In searches with commands following the sort command that require all events to be globally sorted in order. For example, |sort | streamstats global=true is not supported, because the streamstats command in this case expects all events to be sorted in order.
stats The search requires a BY clause.
streamstats Parallel reduce is not supported in the following cases:
  • in searches that use the time window argument.
  • in searches that use both the window and global arguments.
table Parallel reduce is not supported in searches that use the table command with field names that contain wildcards ( * ).
transaction Parallel reduce is not supported in searches with more than one field name in the field list.
tstats The search requires a BY clause.