Reusing subsearch within a search

[fmayot]

I'm using a subsearch multiple times within a search. Is Splunk able to optimize this and run the subsearch only once or do I need to do something else?

[martin_mueller]

Splunk doesn't optimize that on its own, two executions of the same search at almost the same time may yield different results.

As for doing something else, that may depend on your specific issue - do post your search, maybe there's a way.

[martin_mueller]

You could accelerate your subsearch with report acceleration if eligible, or build it upon an accelerated data model. That would still be multiple executions, but they'd be faster and not require manual summary indexing.

Whether that's the best approach, or if there are entirely different ways of solving your requirements is a different matter, for that you'd have to post more info.

[fmayot]

Would there be a way to temporarily cache the results of a subsearch? I've heard about summary indexes but that seems fairly involving for what I'm trying to achieve (essentially ad-hoc queries, often generated by scripts). I can't post a query (I've tried to edit my answer but gave up 30 attemps with the captcha)