Splunk Search

How do subsearch work in distributed search?

karabsze
Path Finder

Per my knowledge, the subsearch result would be acted as parameter to the main search. In the distributed search, would the subsearch result first be consolidated in the search head and then further distributed to the search peer? Thanks!

0 Karma
1 Solution

David
Splunk Employee
Splunk Employee

Yes, it is exactly as you describe. The result is consolidated on the search head.

View solution in original post

David
Splunk Employee
Splunk Employee

Yes, it is exactly as you describe. The result is consolidated on the search head.

thomrs
Communicator

Look at the job inspector it will give you some insight as to how the sub search works.

0 Karma

karabsze
Path Finder

Thanks all!
When distributed to the search peer, how do the results send out? via knowledge bundle?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...