topic Re: Reusing subsearch within a search in Splunk Search

Reusing subsearch within a search

fmayot — Thu, 13 Feb 2014 21:59:54 GMT

I'm using a subsearch multiple times within a search. Is Splunk able to optimize this and run the subsearch only once or do I need to do something else?

Re: Reusing subsearch within a search

martin_mueller — Thu, 13 Feb 2014 22:35:51 GMT

Splunk doesn't optimize that on its own, two executions of the same search at almost the same time may yield different results.

As for doing something else, that may depend on your specific issue - do post your search, maybe there's a way.

Re: Reusing subsearch within a search

fmayot — Thu, 13 Feb 2014 23:23:45 GMT

Would there be a way to temporarily cache the results of a subsearch? I've heard about summary indexes but that seems fairly involving for what I'm trying to achieve (essentially ad-hoc queries, often generated by scripts). I can't post a query (I've tried to edit my answer but gave up 30 attemps with the captcha)

Re: Reusing subsearch within a search

martin_mueller — Fri, 14 Feb 2014 08:15:58 GMT

You could accelerate your subsearch with report acceleration if eligible, or build it upon an accelerated data model. That would still be multiple executions, but they'd be faster and not require manual summary indexing.

Whether that's the best approach, or if there are entirely different ways of solving your requirements is a different matter, for that you'd have to post more info.