Splunk Search
Highlighted

Subsearch - what is the scope of the outer search?

Path Finder

When using subsearch, What is the scope of the outer search? Is the outer search executed against the result set of the inner search?

Tags (1)
0 Karma
Highlighted

Re: Subsearch - what is the scope of the outer search?

Influencer

No, the outer search is executed. The subsearch only appends criteria to the outer search. You can look at the generated criteria by running your subsearch and appending | format

<your subsearch> | format
0 Karma