topic How do subsearch work in distributed search? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-subsearch-work-in-distributed-search/m-p/130951#M35711 <P>Per my knowledge, the subsearch result would be acted as parameter to the main search. In the distributed search, would the subsearch result first be consolidated in the search head and then further distributed to the search peer? Thanks!</P> Thu, 05 Feb 2015 06:05:16 GMT karabsze 2015-02-05T06:05:16Z How do subsearch work in distributed search? https://community.splunk.com/t5/Splunk-Search/How-do-subsearch-work-in-distributed-search/m-p/130951#M35711 <P>Per my knowledge, the subsearch result would be acted as parameter to the main search. In the distributed search, would the subsearch result first be consolidated in the search head and then further distributed to the search peer? Thanks!</P> Thu, 05 Feb 2015 06:05:16 GMT https://community.splunk.com/t5/Splunk-Search/How-do-subsearch-work-in-distributed-search/m-p/130951#M35711 karabsze 2015-02-05T06:05:16Z Re: How do subsearch work in distributed search? https://community.splunk.com/t5/Splunk-Search/How-do-subsearch-work-in-distributed-search/m-p/130952#M35712 <P>Yes, it is exactly as you describe. The result is consolidated on the search head. </P> Thu, 05 Feb 2015 19:37:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-subsearch-work-in-distributed-search/m-p/130952#M35712 David 2015-02-05T19:37:52Z Re: How do subsearch work in distributed search? https://community.splunk.com/t5/Splunk-Search/How-do-subsearch-work-in-distributed-search/m-p/130953#M35713 <P>Look at the job inspector it will give you some insight as to how the sub search works.</P> Thu, 05 Feb 2015 19:42:25 GMT https://community.splunk.com/t5/Splunk-Search/How-do-subsearch-work-in-distributed-search/m-p/130953#M35713 thomrs 2015-02-05T19:42:25Z Re: How do subsearch work in distributed search? https://community.splunk.com/t5/Splunk-Search/How-do-subsearch-work-in-distributed-search/m-p/130954#M35714 <P>Thanks all!<BR /> When distributed to the search peer, how do the results send out? via knowledge bundle?</P> Fri, 13 Feb 2015 11:22:04 GMT https://community.splunk.com/t5/Splunk-Search/How-do-subsearch-work-in-distributed-search/m-p/130954#M35714 karabsze 2015-02-13T11:22:04Z