Three Join Splunk query

[benj851]

Hello; 

I understand joins are expensive in Splunk. When I have a query that has two joins, which query executes first? Asking because I want the most limiting subsearch to execute, followed by a second subsearch, then the main search. 

Ex. 

index=app host=foo Dataquery1
| join type=inner 
[ search index=app host=foo | table Dataquery2.Result1]
| join type=inner 
[search index=app host=foo | table Dataquery2.Result1, Dataquery3.Result1]
|  table Dataquery1.Result, Dataquery2.Result1, Dataquery3.Result1

[gcusello]

Hi @benj851,

sorry but I don't understand whar you really want to know.

Anyway, the search execution order is from left to right, so the main search is always executed as the first.

Only one question, maybe the search sample you inserted in your question isn't real, but if this is your search, you don't need to use join, you could use a simpler search:

index=app host=foo Dataquery1
| table Dataquery1.Result, Dataquery2.Result1, Dataquery3.Result1

If you could share your real search, mayby we could help you better.

Ciao.

Giuseppe