Use SPL commands with knowledge objects

Most commands are processed on both the federated and remote search heads in standard mode federated searches, and require relevant knowledge objects to also be defined on both search heads. However, the following commands are processed only on the federated search head and require relevant knowledge objects to be defined only on the federated search head. As a result, the knowledge object definitions used by these commands don't need to be located on the remote search head in order for searches to complete successfully:

Note: Your search might also need knowledge object definitions on a remote search head if the sendalert, mcollect, or outputlookup command is preceded in the search pipeline by commands that require relevant knowledge object definitions on the remote search head.