Hi,
I have problem with optimizer. It doesn't make pushdown optimization when I'm using join. I have event dataset with some eval fields and regex fields that I'm searching from. My query looks like this:
| from datamodel:"My cool ED"
| search index=A host=B <- important filter
...
and this works fine because Splunk optimizer sees that it can move "important filter to the beginning. After optimize it looks like this:
search (index=A host=B) " my cool ED query"
...
However when I add join after search:
| from datamodel:"My cool ED"
| search index=A host=B <- important filter
| join key [ subsearch from other datamodel ]
...
my important filter is not optimized and stays where it is. Can I force optimizer so it moves index filter to the beginning of optimized query?
