It's intended and documented behaviour to let subsearches finish before starting the main search.
What's not quite intended is to do convoluted chains of join , also with dedup on top - usually these can be solved better and more splunky. However, it's quite hard to create a better alternative with a lot of obfuscation going on and without knowing the requirements for the search. Here's a good overview of the issue: https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html
... View more