Splunk Search

Join turns off predicate pushdown optimization

New Member

I have problem with optimizer. It doesn't make pushdown optimization when I'm using join. I have event dataset with some eval fields and regex fields that I'm searching from. My query looks like this:

| from datamodel:"My cool ED"
| search index=A host=B <- important filter
and this works fine because Splunk optimizer sees that it can move "important filter to the beginning. After optimize it looks like this:

search (index=A host=B) " my cool ED query"

However when I add join after search:
| from datamodel:"My cool ED"
| search index=A host=B <- important filter
| join key [ subsearch from other datamodel ]

my important filter is not optimized and stays where it is. Can I force optimizer so it moves index filter to the beginning of optimized query?

0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...