フリー問題

問題文

A colleague asks why some commands can be pushed out to the indexers while others have to run on the search head. What is the distinction?

選択肢

1. Commands that appear before the first pipe are distributed and everything after it runs centrally, regardless of what the commands themselves do.
2. Commands written in uppercase are distributed and commands written in lowercase run centrally, which is why the search language is case-sensitive.
3. Commands that produce a table are distributed because a table is smaller to transfer, while commands that produce events run centrally on the search head.
4. Commands that can process each event independently can be distributed, while commands that need the whole result set have to run centrally.