Non-streaming commands, by definition, run on the Search Head that initiated the search – and nowhere else.
They’re typically expected to run after all the streaming searches have happened, for any finalization/manipulation of the returned data from all Search Peers running the search
If you run non-streaming commands earlier than necessary in your SPL, you will slow the search down (potentially very dramatically)
Using the Splexicon example cited above, if you run a sort "early" (eg before stats), you force the initiating Search Head to do all of the data processing, instead of merely collating what every eligible Search Peer has preprocessed into a final resultset
from User warren – Stack Overflow https://stackoverflow.com/questions/60343986/is-there-a-similar-command-to-multisearch-in-splunk-for-non-streaming-searches/73114857#73114857
via IFTTT