i am new to Splunk.
Please let me know when to use format and return in a Splunk subsearch.
Hey there,
Here are the details about those commands :
format :
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/format
Return :
http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Return
Hope that helps!
Cheers,
David