Splunk Search

Order of subsearches

yuwtennis
Communicator

Hi !

I would like to ask question regarding to the order of processing of subsearch.

If I write as

index=A [ search hoge ]
| join type=inner fieldA [ search test]

Will the search hoge will be executed first?

Thanks,
Yu

Tags (1)

alacercogitatus
SplunkTrust
SplunkTrust

Wearily, I plodded through the Thickets of Antiquity on my quest for Datalicious, the Ruler of the Datatables. Hark! A sound! It comes from behind the hedge of Hoge. A rustling sound, faint, as if a canary, yellow and brilliant, had expelled vapors of methane. I scarce thought I heard it. And then suddenly, upon the scene burst forth: A hare of good size and build. "Good Morrow", said he, whilst I, perplexed, sat gingerly upon the ground. "I've searched long and I've searched low", he started, "to find the answer to my question." Now I, of being convinced I was dreaming, replied "Go On", as a simpleton might say "More Beer" to the inn keep. "I postulate this: A subsearch, being as lowly as searches go, executes prior to a secondary search command. Am I right in my assumption, or have I perplexed the likes of man?" he questioned. I, Sir Alacer of SplunkAdminary (a silly place long lost in the books of time), replied: "Yes, your assumptions are correct". "Wonderful!" he exclaimed, and raced on his way. As he quickly departed I shouted: "If you have more need for answering, please, comment below!"

MuS
Legend

Honor Sir Alacer! ... and now we sing...

We're Knights of the stats Table
We dance whene'er we're able
We do subsearches and chart scenes
With footwork impeccable ....
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...