Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Why does the subsearch example in the Splunk Search Tutorial seems to repeat itself?

$
0
0
I'm stepping through the main Splunk Search Tutorial. I'm at the "subsearch" section: https://docs.splunk.com/Documentation/Splunk/6.4.3/SearchTutorial/Useasubsearch The cited example search is the following: sourcetype=access_* status=200 action=purchase [search sourcetype=access_* status=200 action=purchase | top limit=1 clientip | table clientip] | stats count, dc(productId), values(productId) by clientip What seems curious to me is that the subsearch begins with the entire content of the "outer search", being `sourcetype=access_* status=200 action=purchase`. It seems odd to me that the subsearch needs to repeat the entire outer search, and then qualifying it. Is it perhaps that this is just a nonsensical subsearch use case?

Viewing all articles
Browse latest Browse all 47296

Trending Articles