https://community.splunk.com/t5/Splunk-Search/Subsearch-what-is-the-scope-of-the-outer-search/m-p/85720#M21896 <P>When using subsearch, What is the scope of the outer search? Is the outer search executed against the result set of the inner search?</P> Tue, 09 Nov 2010 01:11:24 GMT wang 2010-11-09T01:11:24Z https://community.splunk.com/t5/Splunk-Search/Subsearch-what-is-the-scope-of-the-outer-search/m-p/85720#M21896 <P>When using subsearch, What is the scope of the outer search? Is the outer search executed against the result set of the inner search?</P> Tue, 09 Nov 2010 01:11:24 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-what-is-the-scope-of-the-outer-search/m-p/85720#M21896 wang 2010-11-09T01:11:24Z https://community.splunk.com/t5/Splunk-Search/Subsearch-what-is-the-scope-of-the-outer-search/m-p/85721#M21897 <P>No, the outer search is executed. The subsearch only appends criteria to the outer search. You can look at the generated criteria by running your subsearch and appending <CODE>| format</CODE> </P> <PRE><CODE>&lt;your subsearch&gt; | format </CODE></PRE> Tue, 09 Nov 2010 01:26:56 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-what-is-the-scope-of-the-outer-search/m-p/85721#M21897 ziegfried 2010-11-09T01:26:56Z